Refactor of wp-prep (https://github.com/jaredatch/wp-prep/blob/master/wp-prep.php). Completely untested.

wp-prep.php

<?php
/**
 * WordPress Prep.
 *
 * Based from the WordPress Downloader
 * http://www.farinspace.com/wordpress-downloader/
 *
 * @package   wordpress-prep
 * @version   1.0.1
 * @author    Jared Atchison
 * @author    Gary Jones
 * @copyright Copyright (c) 2012, Jared Atchison
 * @link      http://github.com/jaredatch/wp-prep
 * @license   GPL-2.0+
 */

// Amend these default config values as you wish
$config = array(
	'base_theme_zip_prefix' => 'jaredatch-Genesis-Starter', // See maybe_install_base_theme()
	'base_theme_url'        => 'https://github.com/jaredatch/Genesis-Starter-Theme/zipball/master'
	'delete_hello_dolly'    => 1,
	'delete_this_script'    => 1,
	'delete_twentyeleven'   => 1,
	'delete_twentyten'      => 1,
	'genesis_zip_url'      => 'http://yourdomain.com/files/genesis.zip', // Change this
	'install_base_theme'    => 1,
	'install_genesis'       => 1,
	'install_plugin_bundle' => 1,		
	'script_password'       => 'wp-prep-go', // password for this script
	'tgmpa_bundle_url'      => 'http://yourdomain.com/files/plugin-installer.txt', // Change this
	'wp_download_url'       => 'http://wordpress.org/latest.zip', // WP download URL
	'wp_install_directory'  => '', // Where to install WP
);


// That's it! You shouldn't need to edit anything below this line. Upload this file to where the new site will be
// and point your browser at it e.g. http://example.com/wp-prep.php


// Once only functions and $config array is in global scope, then normalize_config() can be added to top of run().
normalize_config();
// Temporary assignment, as second-half of this file is still in global scope.
$success = run(); 

/**
 * Normalize the POSTed values with defaults.
 *
 * @global array $config Defaults.
 */
function normalize_config() {
	global $config;

	foreach ( $config as $key => $value ) {
		if ( 'script_password' == $key ) {
			continue; // Don't let the script password be changed to whatever was POSTed!
		}
		$config[$key] = isset( $_POST[$key] ) ? $_POST[$key] : $value;
	}
}

/**
 * Proceed with preparations.
 *
 * Only actually goes ahead if password is submitted and correct.
 *
 * @todo Add try catch block, and let individual functions throw exceptions if it has trouble.
 *
 * @return bool False if password not submitted or incorrect, true if installation went ahead.
 */
function run();
	if ( ! can_proceed() ) {
		return false;
	}

	install_wordpress();
	maybe_install_genesis();
	maybe_install_base_theme();
	maybe_install_plugin_bundle();
	maybe_delete_core_theme('twentyten');
	maybe_delete_core_theme('twentyeleven');
	maybe_delete_hello_dolly();
	maybe_delete_this_script();
	
	return true;
}

/**
 * Get a value from the config array.
 *
 * @global array $config Config values.
 *
 * @param string $key Config key name.
 *
 * @return mixed|null Null if $key could not be found, config value otherwise.
 */
function config( $key ) {
	global $config;
	return isset( $config[$key] ) ? $config[$key] : null;
}

/**
 * Get a value from the POST data.
 *
 * @param string $key POST key name.
 *
 * @return mixed|null Null if $key could not be found, POST value otherwise.
 */
function post( $key ) {
	return isset( $_POST[$key] ? $_POST[$key] : null;
}

/**
 * Check if installation should go ahead.
 *
 * Password should be submitted, and correct when strictly compared to the config password.
 *
 * @return bool True if installation can proceed, false otherwise.
 */
function can_proceed() {
	return isset( $_POST['finish'] ) && post( 'script_password' ) && post( 'script_password' ) === config( 'script_password' );
}

/**
 * Download and install WordPress.
 */
function install_wordpress() {
	download( 'wordpress.zip' , config( 'wp_download_url' ) );
	unzip( 'wordpress.zip' );
	move_and_delete( 'wordpress', '' );
}

/**
 * Download and install Genesis, if desired.
 *
 * The genesis.zip should be uploaded to somewhere permanent you can access for all new site installs.
 *
 * @todo Craft a POST request to always pull the latest zip from the StudioPress repo.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_install_genesis() {
	if ( ! config( 'install_genesis' ) ) {
		return;
	}

	download( 'genesis.zip' , config( 'genesis_zip_url' ) );
	unzip( 'genesis.zip' );
	move_and_delete( 'genesis', '/wp-content/themes/genesis' );
}

/**
 * Download and install a base theme, if desired.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_install_base_theme() {
	if ( ! config( 'install_base_theme' ) ) {
		return;
	}

	download( 'base-theme.zip' , config( 'base_theme_url' ) );
	unzip( 'base-theme.zip' );
		
	// This is needed because GitHub adds characters to the directory which contains the unzip.
	// If you are not using GitHub this step is not needed.
	$containing_dir =  glob( config( 'base_theme_zip_prefix' ) . '*' , GLOB_ONLYDIR );
		
	move_and_delete( $containing_dir[0], '/wp-content/themes/base' );
}

/**
 * Download and install a plugin bundle data file, if desired.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_install_plugin_bundle() {
	if ( ! config( 'install_plugin_bundle' ) ) {
		return;
	}
	
	download( 'plugin-installer.php' , config( 'tgmpa_bundle_url' ) );
	copy( 'plugin-installer.php', wp_content() . 'plugins/plugin-installer.php' );
	unlink( 'plugin-installer.php' );
}

/**
 * Delete a core theme, if desired.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_delete_core_theme( $themename ) {
	if ( config( 'delete_' . $themename ) ) {
		recursive_remove( wp_content() . 'themes/' . $themename );
	}
}

/**
 * Delete the Hello Dolly core plugin, if desired.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_delete_hello_dolly() {
	if ( config( 'delete_hello_dolly' ) ) {
		unlink( wp_content() . 'plugins/hello.php' );
	}
}

/**
 * Delete this script after installation, if desired.
 *
 * @return null Null if this preparation is not desired.
 */
function maybe_delete_this_script() {
	if ( config( 'delete_this_script' ) ) {
		unlink( 'wp-prep.php' );
	}
}

/**
 * Get path to wp-content directory, including trailing slash.
 *
 * @todo Consider if DIRECTORY_SEPARATOR would be better here.
 *
 * @return null Null if this preparation is not desired.
 */
function wp_content() {
	$wp_directory = config( 'wp_install_directory' );
	if ( ! empty( $wp_directory ) {
		return './' . $wp_directory . '/wp-content/';
	}
	return './wp-content/';
}

/**
 * Downloads the a file from the url provided.
 *
 * @param file, what it will be saved as
 * @param url, location of file to download
 */
function download( $file = '', $url = '' ) {
	
	$user_agent = 'WordPress Setup Script';
	
	$file_open  = fopen( $file, 'w' );
	$file_setup = curl_init();

	curl_setopt(  $file_setup, CURLOPT_USERAGENT,      $user_agent );
	curl_setopt(  $file_setup, CURLOPT_URL,            $url        );
	curl_setopt(  $file_setup, CURLOPT_SSL_VERIFYHOST, 0           );
	curl_setopt(  $file_setup, CURLOPT_SSL_VERIFYPEER, 0           );
	curl_setopt(  $file_setup, CURLOPT_FAILONERROR,    true        );
	curl_setopt(  $file_setup, CURLOPT_HEADER,         0           ); 	
	@curl_setopt( $file_setup, CURLOPT_FOLLOWLOCATION, true        );
	curl_setopt(  $file_setup, CURLOPT_AUTOREFERER,    true        );
	curl_setopt(  $file_setup, CURLOPT_BINARYTRANSFER, true        );
	curl_setopt(  $file_setup, CURLOPT_TIMEOUT,        120         );
	curl_setopt(  $file_setup, CURLOPT_FILE,           $file_open  );

	$file_grab = curl_exec( $file_setup ) ;

	if ( !$file_grab ) {
		die( 'File download error: '. curl_error( $file_setup ) .', please try again.' );
		curl_close( $file_setup );
	}

	// Closing time, open all the doors and let you out into the world
	// Closing time, turn all of the lights on over every boy and every girl
	// Closing time, one last call for alcohol so finish your whiskey or beer
	// Closing time, you don't have to go home but you can't stay here
	fclose( $file_open );

	// Check to see if it downloaded properly
	if ( !file_exists( $file ) ) {
		die( 'Hmmm, looks like the file did not downloaded. (Cannot be found)' );
	}
}

/**
 * Unzips a file provided
 *
 * @param file, name of file to unzip
 */
function unzip( $file ) {
	// Let's unzip this bad boy to a temp wordpr...
	if ( class_exists( 'ZipArchive' ) ) {
		$zip = new ZipArchive;
		if ( $zip->open( $file ) !== TRUE ) {
			die( 'Seems we were unable to open zip file!' );
		}
		$zip->extractTo( './' );
		$zip->close();
	} else {
		// attempt tp fallback on shell command
		@shell_exec( 'unzip -d ./ '. $file );
	}
	// Proceed to nuke the original zip file
	unlink( $file );
}

/**
 * Move and delete. Simple.
 */
function move_and_delete( $what = '', $where = '') {
	global $directory;
	if ( !empty( $directory ) ) {
		// move to specified directory
		recursive_move( './' . $what, './' . $directory . $where );
	} else {
		// move to root directory
		recursive_move( './' . $what, '.' . $where );
	}
	// Remove the old copy, we are done with it!
	recursive_remove( './' . $what );
}

/**
 * Recursive move.
 */
function recursive_move( $src, $dst ) { 
	$dir = opendir( $src ); 
	@mkdir( $dst ); 
	while( false !== ( $file = readdir( $dir ) ) ) { 
		if ( $file != '.' AND $file != '..' ) { 
			if ( is_dir( $src . '/' . $file ) ) { 
				recursive_move( $src . '/' . $file,$dst . '/' . $file ); 
			} else { 
				rename( $src . '/' . $file,$dst . '/' . $file ); 
			} 
		} 
	} 
	closedir($dir); 
} 

/**
 * Recursive REmove.
 */
function recursive_remove ($src ) { 
	$dir = opendir( $src) ; 
	while( false !== ( $file = readdir( $dir ) ) ) { 
		if ( $file != '.' AND $file != '..' ) { 
			if ( is_dir( $src . '/' . $file ) ) { 
				recursive_remove( $src . '/' . $file ); 
			} else { 
				unlink( $src . '/' . $file );
			} 
		} 
	}
	rmdir( $src );
	closedir( $dir ); 
}

/**
 * Promt for the password.
 */
function password_prompt( $status = '') {
	if ( $status == 'fail' ) {
		echo '<div class="message error">Oops! Incorrect password.</div>';
	}
	?>
	<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
	<table class="form-table">
		<tbody>
			<tr>
				<th scope="row"><label for="pass">Password</label></th>
				<td>
					<input name="pass" id="pass" type="password" size="25" value="" />
					<small>A password is required to prevent unauthorized usage of this script.</small>
				</td>
			</tr>
		</tbody>
	</table>
	<p class="submit"><input type="submit" name="submit" value="Submit" /></p>
	</form>
	<?php
}

/** Get the current version of WordPress */
$contents = @file_get_contents( 'http://api.wordpress.org/core/version-check/1.1/' );
if ( !empty( $contents ) ) {
	$version = explode( "\n", $contents );
	$version = $version[2];
}
else { $version = ''; }

/** Set fields and checkboxes */
$url                     = !isset( $url ) ? 'http://wordpress.org/latest.zip' : $url ;
$directory               = !isset( $directory ) ? '' : $directory ;
$input_p                 = !isset( $pass ) ? '' : $pass ;
$option_this             = ( empty ( $option_this ) || ( isset( $option_this ) && $option_this == 1 ) ) ? 'checked="checked"' : '' ;
$option_genesis          = ( isset ( $option_genesis ) && $option_genesis == 1 ) ? 'checked="checked"' : '' ;
$option_base             = ( isset ( $option_base ) && $option_base == 1 ) ? 'checked="checked"' : '' ;
$option_plugins          = ( isset ( $option_plugins  ) && $option_plugins  == 1 ) ? 'checked="checked"' : '' ;
$option_twentyten        = ( isset ( $option_twentyten ) &&  $option_twentyten == 1 ) ? 'checked="checked"' : '' ; 
$option_twentyeleven     = ( isset ( $option_twentyeleven ) &&  $option_twentyeleven == 1 ) ? 'checked="checked"' : '' ; 
?>
<!DOCTYPE html>
<html>
<head>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
	<title>WordPress Prep</title>
	<meta name="robots" content="noindex,nofollow,noarchive">
	<style>
		body { background: #F9F9F9; font-family: Helvetica,Arial,sans-serif; }
		#container { background: white; color: #333; margin: 2em auto; padding: 1em 2em; border-radius: 3px; border: 1px solid #DFDFDF; width: 700px; font-size: 14px; }
		a { color: #21759B; text-decoration: none; }
		a:hover { color: #D54E21 }
		h1 { border-bottom: 1px solid #dadada; clear: both; color: #666; font: 30px Georgia,"Times New Roman",Times,serif; margin: 10px 0 20px 0; padding: 0 0 10px 0; text-align: center; }
		h2 { font-size: 16px }
		p { padding-bottom: 2px; font-size: 14px; line-height: 1.5; }
		code, .code { font-family: Monaco, Andale Mono, Courier New, monospace; border-radius: 5px; background: #f5f5f5; padding: 2px 4px; }
		a img { border: 0 }
		.submit input, .button, .button-secondary { font-family: sans-serif; text-decoration: none; font-size: 14px!important; line-height: 16px; padding: 6px 12px; cursor: pointer; border: 1px solid #bbb; color: #464646; border-radius: 15px; -moz-box-sizing: content-box; -webkit-box-sizing: content-box; box-sizing: content-box; }
		.button:hover, .button-secondary:hover, .submit input:hover { color: #000; border-color: #666; }
		.button, .submit input, .button-secondary { background: #f2f2f2 }
		.button:active, .submit input:active, .button-secondary:active { background: #eee }
		input[type=text], input[type=password] { line-height: 20px; color: #333; font-size: 15px; padding: 3px 5px; border: 1px #DFDFDF solid; border-radius: 3px; }
		.form-table { border-collapse: collapse; margin-top: 1em; width: 100%; }
		.form-table td { margin-bottom: 9px; padding: 10px 20px 10px 0; border-bottom: 8px solid #fff; font-size: 14px; vertical-align: top; }
		.form-table th { font-size: 14px; text-align: left; padding: 18px 20px 10px 0; border-bottom: 8px solid #fff; width: 140px; vertical-align: top; }
		.form-table p { margin: 4px 0 0 0; font-size: 11px; }
		.form-table input[type=text], .form-table input[type=password] { width: 500px }
		.form-table th p { font-weight: normal }
		.form-table small { font-size: 11px; color: #666; display: block; margin-top: 10px; line-height: 16px; }
		.message { border: 1px solid #e6db55; padding: 10px; margin: 10px 0; background-color: #ffffe0; border-radius: 3px; }
		.message.error { background-color: #F2DEDE; border-color: #EED3D7; color: #B94A48; }
		span.note { color: #999; font-style: italic; font-size: 12px; }
		#footer { text-align: center; font-size: 10px; color: #999; padding: 0; margin: 0 0 5px 0; }
		#footer a { color: #999 }
		#footer a:hover { text-decoration: underline }
		#credits { padding: 10px 0; font-size: 12px; line-height: 18px; display: none; }
	</style>
	<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js" type="text/javascript"></script>
	<script type="text/javascript" charset="utf-8">
		jQuery(document).ready(function($){
			// Toggle WordPress download URLs
			var $url_field = $('#wp-url');
			var $url_toggle = $('#url-toggle');
			var $url_current = $('#current');
			var version = '<?php echo $version; ?>';			
			$url_toggle.click(function() {
				if ( $url_toggle.text() == 'trunk' ) {
					$url_field.val('http://wordpress.org/nightly-builds/wordpress-latest.zip');
					$url_toggle.text('the latest version (' + version + ')'); 
					$url_current.text('trunk'); 
				} else {
					$url_field.val('http://wordpress.org/latest.zip');
					$url_toggle.text('trunk'); 
					$url_current.text('the latest version (' + version + ')');  
				};
				return false;
			});
			// Toggle creits
			$('#credits-toggle').click(function() {
				$('#credits').fadeToggle();
				return false;
			});
		});
	</script>
</head>
<body>
	<div id="container">
		<h1>WordPress Prep</h1>
		<?php
		if ( isset( $success ) ) :
			echo '<div class="message success">All done! Jump to the ';
			if ( !empty( $directory ) ) {
				echo '<a href="' . $directory . '/index.php">WordPress configuration</a>.';
			} else {
				echo '<a href="index.php">WordPress configuration</a>.';
			}	
			echo '</div>';
		elseif ( !isset( $pass ) ) :
			password_prompt();
		elseif ( isset( $pass ) && $pass !=  PASSWORD ) :
			password_prompt( 'fail' );
		elseif ( isset( $pass ) && $pass == PASSWORD ) :
		?>
		<p>Let's get started! Just a few handy options below.</p>
		<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
			<table class="form-table">
				<tbody>
					<tr>
						<th scope="row"><label for="wp-url">WordPress Zip URL</label></th>
						<td>
							<input name="url" id="wp-url" type="text" size="25" value="<?php echo $url; ?>" />
							<small>Currently set to <span id="current">the latest version (<?php echo $version; ?>)</span>, would you like to use <a href="#" id="url-toggle">trunk</a>?</small>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="wp-directory">Directory Name</label></th>
						<td>
							<input name="directory" id="wp-directory" type="text" size="25" value="" />
							<small>Specify a directory for the WordPress install. It will be created if given.<em>(Optional)</em></small>
						</td>
					</tr>
				</tbody>
			</table>
			<p><input type="checkbox" name="option_genesis" value="1" <?php echo $option_genesis; ?> /> Install <a href="http://jaredatchison.com/go/genesis/">Genesis Framework</a></p>
			<p><input type="checkbox" name="option_base" value="1" <?php echo $option_base; ?> /> Install base theme</a></p>
			<p><input type="checkbox" name="option_plugins" value="1" <?php echo $option_plugins; ?> /> Install TGMPA plugin bundle</p>
			<p><input type="checkbox" name="option_this" checked="checked" value="1"<?php echo $option_this; ?> /> Delete <code><?php echo $_SERVER['PHP_SELF']; ?></code> when done <span class="note">(recommended)</span></p>
			<p><input type="checkbox" name="option_hello" value="1"<?php echo $option_hello; ?> /> Delete <code>wp-content/plugins/hello.php</code></p>
			<p><input type="checkbox" name="option_twentyten" value="1"<?php echo $option_twentyten; ?> /> Delete <code>wp-content/themes/twentyten</code></p>
			<p><input type="checkbox" name="option_twentyeleven" value="1"<?php echo $option_twentyeleven; ?> /> Delete <code>wp-content/themes/twentyeleven</code></p>
			<input type="hidden" name="pass" value="<?php echo $input_p; ?>">
			<p class="submit"><input type="submit" name="finish" value="Finish Setup!"/></p>
		</form>
		<?php endif; ?>
	</div>
	<div id="footer">
		<a href="http://github.com/jaredatch/">WP Setup script</a> by <a href="http://jaredatchison.com">Jared Atchison</a> - <a href="#" id="credits-toggle">Credits</a>
		<div id="credits"> The script is loosely based off of <a href="http://www.farinspace.com/wordpress-downloader/">WordPress Downloader</a> by farinspace. Plugin bundle activation is powered by <a href="http://tgmpluginactivation.com/">TGM Plugin Activation</a>.<br />The other elements were hacked together by <a href="http://jaredatchison.com">me</a>!</div>
	</div>
</body>
</html>