Pack recon — read-only
2026-11-14 18:11:11 · 19,948 chars
Press COPY and paste it in chat. Passwords and hashes appear only as their length and type, never as values.
COPY
PACK-RECON 2026-11-14 18:11:11 root: /home/admihkbe/new.adminsilver.com host: new.adminsilver.com === PHP =========================================================== version 8.2.35 pdo_mysql yes mysqli yes curl yes zip yes openssl yes mbstring yes gd yes fileinfo yes ZipArchive yes exec() yes memory_limit 1024M max_execution 180s === FILE TREE (top level of public_html) ========================== .well-known/ dir 1 files 27 B SETUP.md file 4.6 KB admin/ dir 34 files 855.3 KB admin-move.php file 16 KB api/ dir 20 files 193.5 KB assets/ dir 1 files 7.8 KB audit.php file 24 KB auth-export.php file 2.1 KB cgi-bin/ dir 0 files 0 B <- excluded from the package check-site.php file 13 KB config.php file 585 B config.php.bak-20260918-140657 file 573 B <- excluded core/ dir 11 files 32 KB delivery-check.php file 11.3 KB error_log file 26.7 KB <- excluded fix-api-db.php file 10.8 KB lint-satellite.php file 8.9 KB mail-check.php file 14.3 KB mail-enquiry-test.php file 10.5 KB mail-enquiry-test_1.php file 10.5 KB mail-export.php file 832 B mail-export.php.bak-domain file 833 B <- excluded pack-admin.php file 20.5 KB pack-recon.php file 16.9 KB patch-jurisdiction.php file 37.4 KB patch-mail-google.php file 5.6 KB patch-mail-google.php.bak-domain file 5.6 KB <- excluded patch-photos.php file 38.2 KB patch-photos.php.bak-domain file 38.2 KB <- excluded patch10-mail-encoding.php file 13.4 KB patch11-footer-gap.php file 7.2 KB patch12-enquiry-email.php file 10.7 KB patch12-enquiry-email_1.php file 10.7 KB patch12b.php file 10.9 KB patch13-one-per-vehicle.php file 10.6 KB patch14-block-duplicate.php file 10.1 KB patch15-fix-rule.php file 10.2 KB patch15b.php file 10.2 KB patch16-enquiry-message.php file 9.3 KB patch2-baseurl.php file 9.6 KB patch3-reviews-jurisdiction.php file 13 KB patch4-mail.php file 15.4 KB patch5-copy.php file 10.7 KB patch6-fix.php file 11.3 KB patch7-vehicle-info.php file 8.7 KB patch8-logging-wording.php file 11.2 KB patch9-titles.php file 10.1 KB patch9-titles_1.php file 11.5 KB patch9b.php file 11.5 KB public_html(1).zip file 75.2 MB repara-inventory-mobil.php file 13.2 KB script-451122.php.txt file 176.1 KB show-enquiry-email.php file 3.9 KB site-template/ dir 26 files 186.8 KB smtp-check.php file 10.9 KB smtp-set.php file 7.6 KB smtp-set.php.bak-domain file 7.6 KB <- excluded superadmin/ dir 2 files 425 B tools.php file 10 KB upload-audit.php file 7 KB upload-audit.php.bak-domain file 7 KB <- excluded uploads/ dir 5 files 1.4 MB whereami.php file 11.2 KB wipe-inventory.php file 12.7 KB wipe-inventory.php.bak-domain file 12.7 KB <- excluded TOTAL 156 files, 78.6 MB === THE FILES THE NEW DESIGN WILL TOUCH =========================== admin/_satellite/index.php.tpl 87.2 KB the satellite template - all markup site-template/assets/style.css 38.2 KB satellite stylesheet, served live from the admin site-template/ 26 files 186.8 KB whole folder core/functions.php 6.8 KB shared helpers core/smtp_mailer.php 5.3 KB mail (holds the mailbox password) api/ 20 files 193.5 KB the endpoints satellites call admin/ 34 files 855.3 KB the panel === UPLOADED MEDIA (excluded: the new admin starts with no content) ==== uploads/ 5 files 1.4 MB === CONFIG FILES (constant names and value shapes, never values) ==== --- config.php --- 585 B, 16 lines define DB_HOST = localhost define DB_NAME = admihkbe_silver define DB_USER = admihkbe_silver define DB_PASS = [15 chars] define SUPERADMIN_DOMAIN = https://new.adminsilver.com define PLATFORM_NAME = Silver Admin -- shape of the file -- 2 | // ========================================================= 3 | // CONFIGURATION - fill in with real values from cPanel > MySQL Databases 4 | // ========================================================= 6 | define('DB_HOST', 'localhost'); 7 | define('DB_NAME', 'admihkbe_silver'); 8 | define('DB_USER', 'admihkbe_silver'); 9 | define('***', '***'); 11 | // The hosting account's main domain = the Super Admin panel 12 | // (no www, lowercase) 13 | define('SUPERADMIN_DOMAIN', 'https://new.adminsilver.com'); 15 | // Platform name, shown in the super admin panel 16 | define('PLATFORM_NAME', 'Silver Admin'); --- api/_api_inc.php --- 5.4 KB, 139 lines define DB_HOST = localhost define DB_NAME = teqoljta_db define DB_USER = teqoljta_db define DB_PASS = [15 chars] define API_KEY = [looks like sha256 (64 hex)] -- shape of the file -- 2 | /** 3 | * ============================================================================= 4 | * API SATELIT -- bootstrap comun 5 | * Se urca pe ADMIN, in: public_html/api/ 6 | * URL rezultat: https://adminsiteuk.com/api/<endpoint>.php 7 | * ============================================================================= 8 | * Sateliţii nu se conecteaza la MySQL. Cer datele de aici, prin HTTPS, deci 9 | * functioneaza pe orice hosting, indiferent de firewall sau de Remote MySQL. 10 | * ============================================================================= 11 | */ 15 | // Fara Access-Control-Allow-Origin: apelurile sunt server-to-server (cURL din 16 | // index.php al satelitului), nu din browser. Nu deschidem API-ul catre pagini terte. 18 | /* ------------------------- CONFIGURARE ------------------------- */ 20 | define('DB_HOST', 'localhost'); 21 | define('DB_NAME', 'teqoljta_db'); // baza de pe ACEST server 22 | define('DB_USER', 'teqoljta_db'); 23 | define('***', '***'); // completeaza 25 | // URL-ul public al acestui admin, folosit pentru a construi adresele pozelor 26 | define('BASE_URL', ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http') 29 | // Cheie partajata cu satelitii. Aceeasi valoare trebuie pusa in index.php, 30 | // la constanta API_KEY. Genereaza una lunga si aleatoare. 31 | define('***', '***'); 33 | define('API_DEBUG', false); // true doar temporar, la diagnostic 35 | /* ------------------------- INFRASTRUCTURA ------------------------- */ 37 | function json_out($data, $code = 200) { 43 | function json_err($error, $code = 400) { 47 | /** Verifica cheia partajata. Se apeleaza la inceputul fiecarui endpoint. */ 48 | function require_key() { 49 | $sent = $_SERVER['***'] ?? ($_REQUEST['k'***''); 50 | if (!is_string($sent) || !hash_equals(API_KEY, $sent)) { 55 | function db(): PDO { 57 | if ($pdo !== null) return $pdo; 59 | $pdo = new PDO( 72 | return $pdo; 75 | /* ------------------------- HELPERE ------------------------- */ 77 | /** Transforma un nume de fisier din DB intr-un URL absolut catre acest admin. */ 78 | function upload_url($file, $folder) { 79 | $file = trim((string)$file); 80 | if ($file === '') return null; 81 | if (preg_match('#^(https?:)?//#i', $file)) return $file; // deja absolut 82 | return BASE_URL . 'uploads/' . trim($folder, '/') . '/' . ltrim($file, '/'); 85 | function clean_domain($d) { 86 | $d = strtolower(trim((string)$d)); 87 | $d = preg_replace('#^https?://#i', '', $d); 88 | $d = preg_replace('#^www\.#', '', $d); 89 | $d = preg_replace('#[:/].*$#', '', $d); // taie portul si calea 90 | return $d; 93 | /** Cauta site-ul dupa domeniu. Returneaza randul brut din tabela sites. */ 94 | function site_by_domain($domain) { 95 | $domain = clean_domain($domain); 96 | if ($domain === '') return null; 97 | $stmt = db()->prepare("SELECT * FROM sites WHERE domain = ? LIMIT 1"); 98 | $stmt->execute([$domain]); 99 | $row = $stmt->fetch(); 100 | return $row ?: null; 103 | /** 104 | * Rezolva site-ul din parametrul ?domain= si opreste executia cu eroarea 105 | * potrivita daca nu exista sau e dezactivat. Folosit de toate endpoint-urile. 106 | */ 107 | function require_site() { ... 11 more lines --- core/smtp_mailer.php --- 5.3 KB, 130 lines define SMTP_HOST = mail.admingrandfather.com define SMTP_USER = noreply@admingrandfather.com define SMTP_PASS = [8 chars] define SMTP_FROM = noreply@admingrandfather.com $name = Website -- shape of the file -- 2 | // Minimal, dependency-free SMTP mailer (implicit SSL/TLS on port 465, AUTH LOGIN). 3 | // Used to send contact-form / vehicle-enquiry notifications to the contact email 4 | // configured for each site, with Reply-To set to the customer's address. 6 | defined('SMTP_HOST') || define('SMTP_HOST', 'mail.admingrandfather.com'); 7 | defined('SMTP_PORT') || define('SMTP_PORT', 465); 8 | defined('SMTP_USER') || define('SMTP_USER', 'noreply@admingrandfather.com'); 9 | defined('***') || define('***', '***'); 10 | defined('SMTP_FROM') || define('SMTP_FROM', 'noreply@admingrandfather.com'); 12 | function smtp_mime_header($str) { 13 | if (preg_match('/[^\x20-\x7e]/', $str)) { 14 | return '=?UTF-8?B?' . base64_encode($str) . '?='; 16 | return $str; 19 | /** Numele expeditorului ca „display name” valid RFC 5322: între ghilimele, ca virgula / & / punctele 20 | * din numele firmei („AUTO SALES & CONSIGNMENT, L.L.C.”) să nu rupă antetul From (Google: 550 5.7.1). * 21 | function smtp_from_name($name) { 22 | $name = trim(preg_replace('/[\r\n\t"\\\\]+/', ' ', (string)$name)); 23 | if ($name === '') $name = 'Website'; 24 | if (preg_match('/[^\x20-\x7e]/', $name)) return '=?UTF-8?B?' . base64_encode($name) . '?='; 25 | return '"' . $name . '"'; 28 | /** 29 | * Sends a plain-text email via SMTP (SSL, AUTH LOGIN). Returns true on success, 30 | * false on failure (never throws - failures are logged via error_log so a mail 31 | * problem never breaks the page for the visitor). 32 | */ 33 | function smtp_send($to, $subject, $body, $replyTo = null, $fromName = null, $html = null) { 34 | $fp = @stream_socket_client('ssl://' . SMTP_HOST . ':' . SMTP_PORT, $errno, $errstr, 15); 35 | if (!$fp) { 37 | return false; 41 | $read = function () use ($fp) { 42 | $data = ''; 44 | $data .= $line; 45 | if (isset($line[3]) && $line[3] === ' ') break; 47 | return $data; 49 | $write = function ($cmd) use ($fp) { 53 | $resp = $read(); 54 | if (substr($resp, 0, 3) !== '220') { fclose($fp); error_log("SMTP greeting failed: $resp"); return false; } 56 | // Identify with the web host: receiving servers check that the EHLO name 57 | // looks like it belongs to the sender. 58 | $ehlo = $_SERVER['HTTP_HOST'] ?? SMTP_HOST; 59 | $ehlo = preg_replace('/[^A-Za-z0-9.\-]/', '', $ehlo) ?: SMTP_HOST; 60 | $write('EHLO ' . $ehlo); 61 | $read(); 63 | $write('AUTH LOGIN'); 64 | $read(); 65 | $write(base64_encode(SMTP_USER)); 66 | $read(); 67 | $write(base64_encode(SMTP_PASS)); 68 | $resp = $read(); 69 | if (substr($resp, 0, 3) !== '235') { fclose($fp); error_log("SMTP auth failed: $resp"); return false; } 71 | $write('MAIL FROM:<' . SMTP_FROM . '>'); 72 | $resp = $read(); 73 | if (substr($resp, 0, 3) !== '250') { fclose($fp); error_log("SMTP MAIL FROM failed: $resp"); return false; } 75 | $write('RCPT TO:<' . $to . '>'); 76 | $resp = $read(); 77 | if (substr($resp, 0, 3) !== '250' && substr($resp, 0, 3) !== '251') { fclose($fp); error_log("SMTP RCPT TO fai 79 | $write('DATA'); 80 | $resp = $read(); 81 | if (substr($resp, 0, 3) !== '354') { fclose($fp); error_log("SMTP DATA failed: $resp"); return false; } 83 | $displayName = $fromName ?: 'Website'; 84 | $domain = substr(strrchr(SMTP_FROM, '@'), 1) ?: SMTP_HOST; ... 26 more lines === DATABASE ====================================================== connected via the DB_* constants server: 11.4.13-MariaDB-cll-lve 8 tables table rows columns ---------------------------------------------------------------------------------------------------- contact_messages 0 id:int site_id:int vehicle_id:int name:varchar email:varchar phone:varchar message:text is_read:tinyint created_at:timestamp review_sites 0 review_id:int site_id:int reviews 57 id:int site_id:int author_name:varchar rating:tinyint content:text image_path:varchar is_approved:tinyint created_at:timestamp sites 0 id:int domain:varchar jurisdiction:varchar company_name:varchar company_short_name:varchar company_number:varchar year_founded:smallint theme_color:varchar logo_path:varchar contact_email:varchar contact_phone:varchar address_line1:varchar address_line2:varchar city:varchar state:varchar postcode:varchar country:varchar bank_name:varchar bank_account_name:varchar bank_sort_code:varchar bank_account_number:varchar is_active:tinyint created_at:timestamp updated_at:timestamp users 1 id:int site_id:int role:enum name:varchar email:varchar password_hash:varchar is_active:tinyint created_at:timestamp vehicle_images 0 id:int vehicle_id:int path:varchar sort_order:int vehicle_sites 0 vehicle_id:int site_id:int vehicles 0 id:int site_id:int slug:varchar title:varchar make:varchar model:varchar variant:varchar registration_number:varchar year:smallint mileage:int fuel:varchar transmission:varchar body_type:varchar color:varchar mot_expiry:date price:decimal status:enum description:text created_by:int created_at:timestamp updated_at:timestamp === ADMIN LOGIN =================================================== table that holds accounts: users id int(11) NOT NULL site_id int(11) role enum('super_admin','site_admin') NOT NULL name varchar(255) NOT NULL email varchar(255) NOT NULL password_hash varchar(255) NOT NULL is_active tinyint(1) NOT NULL default 1 created_at timestamp default current_timestamp() one existing row, every value masked: id 5 site_id role super_admin name admin email a***@silver.com password_hash bcrypt hash ($2y$), 60 chars is_active 1 created_at 2026-11-12 11:44:59 how the code checks a password: admin/satellite_download.php 26 | return substr(hash('...', $apiKey . '...' . strtolower($domain)), 0, 24); core/Auth.php 7 | if (!$user || !password_verify($password, $user['...'])) { core/Auth.php 13 | unset($user['...']); auth-export.php 13 | if (preg_match('...'"..."]\]|function\s+(require_login|login|check_login|is_logged)/i', $c site-template/admin/impersonate.php 18 | unset($admin['...']); pack-admin.php 300 | 'auth'...'table' => 'users', '...' => '...', 'algo' => '...'], tools.php 76 | if (!$passCol && preg_match('...', $c)) $passCol = $c; tools.php 87 | if (preg_match('...', (string)$old) || $old === '' || $old === null) return password_hash( tools.php 88 | if (preg_match('...', $old)) return md5($new); tools.php 89 | if (preg_match('...', $old)) return sha1($new); tools.php 90 | if (preg_match('...', $old)) return hash('...', $new); tools.php 91 | return password_hash($new, PASSWORD_DEFAULT); admin-move.php 28 | foreach (['...', '...', '...', 'pass', 'pwd'] as $p) if (in_array($p, $names, true)) { $pw admin-move.php 40 | $usesVerify = strpos($loginSrc, '...') !== false; admin-move.php 48 | $hash = password_hash($p1, PASSWORD_DEFAULT); admin-move.php 68 | $val = ($usesVerify || stripos($cfgPass, 'HASH') !== false) ? password_hash($p1, PASSWORD_ === WHAT A SATELLITE IS GIVEN ===================================== API_BASE ADMIN_ROOT . 'api/' API_KEY [11 chars] CACHE_TTL 90 CACHE_DIR __DIR__ . '/.cache' FORCE_DOMAIN '' BASE_URL not a define - probably injected when you download placeholders the downloader fills in (looking for {{ }} or __X__): ADMIN_ROOT, API_KEY, SAT_CHECK_KEY, DIR === END =========================================================== Nothing was modified. Delete this file once you have copied the report.
Delete this file once you have copied it.