File: /home/everest2/.bash_history
#1778170900
grep -R "phar://" /home/everest2/hamrosafetytankycleaning.com
#1778171352
/opt/alt/php82/usr/bin/php -m | egrep "mysqli|mysqlnd"
#1778171390
/opt/alt/php82/usr/bin/php -r "var_dump(function_exists('mysqli_report'));"
#1778171424
php -v
#1778171430
where php
#1778171444
which php
#1778171477
cd ..
#1778171480
cd //
#1778171483
cd ..
#1778171486
ls
#1778171489
cd local
#1778171499
cd bon
#1778171501
cd bin
#1778171504
ls
#1778171515
cd php
#1778171666
grep -R "phar://"
#1778171710
grep -R "mysqli_report()"
#1778392089
grep -rl "eval(urldecode" public_html/
#1778392114
grep -rl "haxorcloud" public_html/
#1778392133
grep -rl "acidpoll" public_html/
#1778392150
grep -rl "eval(base64_decode" public_html/
#1778392231
rm public_html/zh2.php
#1778392243
rm public_html/classwithtostring.php
#1778392253
ls public_html/zh2.php public_html/classwithtostring.php
#1778392271
head -20 public_html/index.php
#1778392324
grep -rl "file_get_contents" public_html/ --include="*.php" | grep -v "wp-includes" | grep -v "wp-admin"
#1778392431
grep -rl "str_rot13\|gzinflate\|gzuncompress" public_html/ --include="*.php" | grep -v "wp-includes" | grep -v "wp-admin"
#1778392442
find public_html/ -name "*.php" -mtime -60 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/uploads/*" -not -path "*/elementor/*"
#1778392506
head -20 public_html/cdn3.php
#1778393603
rm public_html/cdn3.php
#1778393613
find public_html/ -name "avv.gz"
#1778393621
find public_html/ -name "*.gz"
#1778393635
head -20 public_html/style.php
#1778393645
head -20 public_html/wp-content/maintenance.php
#1778393688
rm public_html/style.php
#1778393697
grep -rl "compress.zlib" public_html/ --include="*.php"
#1778393707
grep -rl "include \$" public_html/ --include="*.php" | grep -v "wp-includes" | grep -v "wp-admin" | grep -v "elementor"
#1778393724
find public_html/ -name "*.php" -mtime -60 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/uploads/*" -not -path "*/elementor/*"
#1778394013
grep -rl "haxorcloud\|acidpoll\|eval(urldecode" hamrosafetytankycleaning.com/ --include="*.php"
#1778394078
head -20 hamrosafetytankycleaning.com/ml1.php
#1778394113
rm hamrosafetytankycleaning.com/ml1.php
#1778394124
rm hamrosafetytankycleaning.com/vh4.php
#1778394138
head -20 hamrosafetytankycleaning.com/index.php
#1778394205
find hamrosafetytankycleaning.com/ -name "x.zip"
#1778394218
find hamrosafetytankycleaning.com/ -name "*.zip"
#1778394265
rm hamrosafetytankycleaning.com/ml1.php
#1778394268
rm hamrosafetytankycleaning.com/vh4.php
#1778394328
cat > hamrosafetytankycleaning.com/index.php << 'EOF'
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
EOF
#1778394348
head -15 hamrosafetytankycleaning.com/index.php
#1778394477
grep -rl "str_rot13\|gzinflate\|compress.zlib\|eval(base64_decode" hamrosafetytankycleaning.com/ --include="*.php"
#1778394520
rm hamrosafetytankycleaning.com/cdn3.php
#1778394531
ls hamrosafetytankycleaning.com/wp-includes+49/
#1778394539
ls hamrosafetytankycleaning.com/wp-content+49/
#1778394575
rm -rf hamrosafetytankycleaning.com/wp-includes+49/
#1778394578
rm -rf hamrosafetytankycleaning.com/wp-content+49/
#1778394587
ls hamrosafetytankycleaning.com/ | grep "+49"
#1778394625
rm -rf hamrosafetytankycleaning.com/cgi-bin+49/
#1778394625
rm -rf hamrosafetytankycleaning.com/new+49/
#1778394627
rm -rf hamrosafetytankycleaning.com/wp-admin+49/
#1778394637
ls hamrosafetytankycleaning.com/ | grep "+49"
#1778394645
ls public_html/ | grep "+49"
#1778394659
cat hamrosafetytankycleaning.com/mine.php
#1778394669
ls public_html/ | grep "+49"
#1778394715
find hamrosafetytankycleaning.com/ -name "*.php" -mtime -60 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/uploads/*" -not -path "*/elementor/*"
#1778394806
rm hamrosafetytankycleaning.com/ok.php
#1778394806
rm hamrosafetytankycleaning.com/wp-security.php
#1778394806
rm hamrosafetytankycleaning.com/eval.php
#1778394806
rm hamrosafetytankycleaning.com/anz.php
#1778394806
rm hamrosafetytankycleaning.com/yro.php
#1778394806
rm hamrosafetytankycleaning.com/mineragrap.php
#1778394806
rm hamrosafetytankycleaning.com/db.php
#1778394808
rm hamrosafetytankycleaning.com/rg0.php
#1778394816
rm -rf hamrosafetytankycleaning.com/.well-known/acme-challenge/network/
#1778394816
rm -rf hamrosafetytankycleaning.com/.well-known/acme-challenge/cgi-bin/
#1778394816
rm -rf hamrosafetytankycleaning.com/cgi-bin/widgets/
#1778394818
rm -rf hamrosafetytankycleaning.com/cgi-bin/fonts/
#1778394824
rm hamrosafetytankycleaning.com/wp-content/themes/hello-elementor/assets/images/SecretStream/index.php
#1778394824
rm hamrosafetytankycleaning.com/wp-content/themes/hello-elementor-child/SecretStream/index.php
#1778394827
rm -rf hamrosafetytankycleaning.com/wp-content/upgrade/images/
#1778394836
head -5 hamrosafetytankycleaning.com/mine.php
#1778394836
head -5 hamrosafetytankycleaning.com/wp-content/themes/hello-elementor/template-parts/index.php
#1778394837
head -5 hamrosafetytankycleaning.com/wp-content/maintenance/assets/network/index.php
#1778394919
ls hamrosafetytankycleaning.com/wp-config.php
#1778394919
ls hamrosafetytankycleaning.com/wp-blog-header.php
#1778394920
ls hamrosafetytankycleaning.com/wp-login.php
#1778394929
cat hamrosafetytankycleaning.com/.htaccess
#1778394974
tail -30 hamrosafetytankycleaning.com/logs/error_log
#1778394982
tail -30 ~/logs/hamrosafetytankycleaning.com.error_log
#1778394994
head -10 hamrosafetytankycleaning.com/wp-config.php
#1778395003
ls -la hamrosafetytankycleaning.com/ | head -20
#1778395037
tail -50 hamrosafetytankycleaning.com/error_log
#1778395105
cat hamrosafetytankycleaning.com/index.php
#1778395149
rm hamrosafetytankycleaning.com/aiz.txt
#1778395149
rm hamrosafetytankycleaning.com/ark.txt
#1778395174
rm hamrosafetytankycleaning.com/aiz.txt
#1778395174
rm hamrosafetytankycleaning.com/ark.txt
#1778395199
rm hamrosafetytankycleaning.com/indexgz.php
#1778395199
rm hamrosafetytankycleaning.com/style.php
#1778395199
rm hamrosafetytankycleaning.com/index.php.backup
#1778395199
rm hamrosafetytankycleaning.com/aiz.txt
#1778395204
rm hamrosafetytankycleaning.com/nt.txt
#1778395213
rm hamrosafetytankycleaning.com/indexgz.php
#1778395213
rm hamrosafetytankycleaning.com/style.php
#1778395213
rm hamrosafetytankycleaning.com/index.php.backup
#1778395213
rm hamrosafetytankycleaning.com/aiz.txt
#1778395218
rm hamrosafetytankycleaning.com/nt.txt
#1778395321
curl -I http://hamrosafetytankycleaning.com
#1778395336
ping hamrosafetytankycleaning.com
#1778396025
ls ~
#1778396056
find ~ -maxdepth 2 -name "*.php" -mtime -60 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/uploads/*" -not -path "*/elementor/*" -not -path "*/updraftplus/*" -not -path "*/public_html/*" -not -path "*/hamrosafetytankycleaning.com/*" 2>/dev/null | grep -v "wp-content/plugins" | grep -v "wp-content/themes/hello-elementor/inc"
#1778396105
rm -f ~/everestlex.com/cdn3.php ~/onedaycricketacademy.com/wp-security.php ~/onedaycricketacademy.com/666.php ~/onedaycricketacademy.com/vh4.php ~/onedaycricketacademy.com/mineragrap.php ~/ninja.everestpeakgrowth.com/wp-security.php ~/ninja.everestpeakgrowth.com/indexgz.php ~/ninja.everestpeakgrowth.com/mineragrap.php ~/ehaatbazar.com/ammika.php ~/ehaatbazar.com/saiga.php ~/ehaatbazar.com/zh2.php ~/ehaatbazar.com/cdn3.php ~/wrightmarketingteams.com/wp-securitiy.php ~/wrightmarketingteams.com/cdn3.php ~/prakash.everestpeakgrowth.com/wp-securitiy.php ~/fusionfeastky.com/ok.php ~/fusionfeastky.com/wp-security.php ~/fusionfeastky.com/ml1.php ~/fusionfeastky.com/wp-signug.gz.p.php ~/fusionfeastky.com/0zz.php ~/fusionfeastky.com/mineragrap.php ~/fusionfeastky.com/classwithtostring.php ~/fusionfeastky.com/cdn3.php ~/fusionfeastky.com/style.php ~/ehaatbazar.everestpeakgrowth.com/z12.php ~/ehaatbazar.everestpeakgrowth.com/bolt.php ~/ehaatbazar.everestpeakgrowth.com/z9.php ~/ehaatbazar.everestpeakgrowth.com/123.php ~/sepressurewashing.everestpeakgrowth.com/123.zip.php ~/sepressurewashing.everestpeakgrowth.com/wp-security.php ~/wilson.everestpeakgrowth.com/wp-securitiy.php ~/.trash/wp-blog-header.php ~/.trash/wp-security.php ~/.trash/mine2.php
#1778396118
head -10 ~/onedaycricketacademy.com/index.php
#1778396118
head -10 ~/ninja.everestpeakgrowth.com/index.php
#1778396118
head -10 ~/fusionfeastky.com/index.php
#1778396121
head -10 ~/sepressurewashing.everestpeakgrowth.com/index.php
#1778396159
for domain in onedaycricketacademy.com ninja.everestpeakgrowth.com sepressurewashing.everestpeakgrowth.com; do
cat > ~/$domain/index.php << 'EOF'
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
EOF
done
#1778396172
head -5 ~/onedaycricketacademy.com/index.php
#1778396172
head -5 ~/ninja.everestpeakgrowth.com/index.php
#1778396174
head -5 ~/sepressurewashing.everestpeakgrowth.com/index.php
#1778396184
find ~ -maxdepth 2 -name "*+49*" -type d 2>/dev/null
#1778396194
ls -la ~/onedaycricketacademy.com/mine.php
#1778396211
head -10 ~/onedaycricketacademy.com/index.php
#1778396211
head -10 ~/ninja.everestpeakgrowth.com/index.php
#1778396211
head -10 ~/fusionfeastky.com/index.php
#1778396214
head -10 ~/sepressurewashing.everestpeakgrowth.com/index.php
#1778396243
[everest2@s1299 ~]$ ls ~
#1778396243
abc.everestpeakgrowth.com mail tmp
#1778396243
abpressurewashing.everestpeakgrowth.com moorsepressurewashing.everestpeakgrowth.com toy.everestpeakgrowth.com
#1778396243
access-logs newsportal.everestpeakgrowth.com umesh.everestpeakgrowth.com
#1778396243
berryspressurewashing.everestpeakgrowth.com ninja.everestpeakgrowth.com under_construction
#1778396243
bigriver.everestpeakgrowth.com onedaycricketacademy.com watch.everestpeakgrowth.com
#1778396243
chuckspowerwashing.everestpeakgrowth.com onedaycricketacademy.everestpeakgrowth.com wilson.everestpeakgrowth
#1778396243
dailobhari.everestpeakgrowth.com onedaycricketshop.everestpeakgrowth.com wilson.everestpeakgrowth.com
#1778396243
dentalmockupmain.everestpeakgrowth.com padmnadental.everestpeakgrowth.com wmslp
#1778396243
dibyanshdental.everestpeakgrowth.com parmentierspowerwashing.everestpeakgrowth.com wmslp.everestpeakgrowth.com
#1778396243
dipakbhandari.info.np perrinelawncare.everestpeakgrowth.com wordpress-backups
#1778396243
dipak.everestpeakgrowth.com prakash.everestpeakgrowth.com wp-activate.php
#1778396243
drewspressurewashing.everestpeakgrowth.com public_ftp wp-admin
#1778396243
ehaatbazar.com public_html wp-blog-header.php
#1778396243
ehaatbazar.everestpeakgrowth.com pwlexingtonky.everestpeakgrowth.com wp-comments-post.php
#1778396243
etc pwlouisvilleky.everestpeakgrowth.com wp-config-sample.php
#1778396243
everestlex.com qualitydentalcare.com.np wp-content
#1778396243
everestpressurewashing.everestpeakgrowth.com rajat.everestpeakgrowth.com wp-cron.php
#1778396243
example.everestpeakgrowth.com raykay.everestpeakgrowth.com wp-includes
#1778396243
foodtruck.everestpeakgrowth.com readme.html wp-links-opml.php
#1778396243
fusionfeastky.com roofing.everestpeakgrowth.com wp-load.php
#1778396243
gaurav.everestpeakgrowth.com salon.everestpeakgrowth.com wp-login.php
#1778396243
hamrosafetytankycleaning.com samyog.everestpeakgrowth.com wp-mail.php
#1778396243
index.php sepressurewashing.everestpeakgrowth.com wp-settings.php
#1778396243
junkremoval.everestpeakgrowth.com site_publisher wp-signup.php
#1778396243
kypowerwashing.everestpeakgrowth.com softaculous_backups wp-trackback.php
#1778396243
lancopavingllc.everestlex.com ssl wrightmarketingteams.com
#1778396243
lawncare.everestpeakgrowth.com susmita2.everestpeakgrowth.com www
#1778396243
license.txt susmita3.everestpeakgrowth.com www.ehaatbazar.com
#1778396243
linestriping.everestpeakgrowth.com susmita.everestpeakgrowth.com xmlrpc.php
#1778396243
logs tejassoftwash.everestpeakgrowth.com
#1778396243
lscache thanka.everestpeakgrowth.com
#1778396243
[everest2@s1299 ~]$ find ~ -maxdepth 2 -name "*.php" -mtime -60 > -not -path "*/wp-includes/*" > -not -path "*/wp-admin/*" > -not -path "*/uploads/*" > -not -path "*/elementor/*" > -not -path "*/updraftplus/*" > -not -path "*/public_html/*" > -not -path "*/hamrosafetytankycleaning.com/*" > 2>/dev/null | grep -v "wp-content/plugins" | grep -v "wp-content/themes/hello-elementor/inc"
#1778396243
/home/everest2/everestlex.com/cdn3.php
#1778396243
/home/everest2/onedaycricketacademy.com/wp-security.php
#1778396243
/home/everest2/onedaycricketacademy.com/mine.php
#1778396243
/home/everest2/onedaycricketacademy.com/666.php
#1778396243
/home/everest2/onedaycricketacademy.com/vh4.php
#1778396243
/home/everest2/onedaycricketacademy.com/index.php
#1778396243
/home/everest2/onedaycricketacademy.com/mineragrap.php
#1778396243
/home/everest2/ninja.everestpeakgrowth.com/wp-security.php
#1778396243
/home/everest2/ninja.everestpeakgrowth.com/indexgz.php
#1778396243
/home/everest2/ninja.everestpeakgrowth.com/index.php
#1778396243
/home/everest2/ninja.everestpeakgrowth.com/mineragrap.php
#1778396243
/home/everest2/qualitydentalcare.com.np/index.php
#1778396243
/home/everest2/ehaatbazar.com/ammika.php
#1778396243
/home/everest2/ehaatbazar.com/saiga.php
#1778396243
/home/everest2/ehaatbazar.com/zh2.php
#1778396243
/home/everest2/ehaatbazar.com/cdn3.php
#1778396243
/home/everest2/wrightmarketingteams.com/wp-securitiy.php
#1778396243
/home/everest2/wrightmarketingteams.com/cdn3.php
#1778396243
/home/everest2/.softaculous/uibqd_installations.php
#1778396243
/home/everest2/.softaculous/installations.php
#1778396243
/home/everest2/prakash.everestpeakgrowth.com/wp-securitiy.php
#1778396243
/home/everest2/fusionfeastky.com/ok.php
#1778396243
/home/everest2/fusionfeastky.com/wp-security.php
#1778396243
/home/everest2/fusionfeastky.com/ml1.php
#1778396243
/home/everest2/fusionfeastky.com/wp-signug.gz.p.php
#1778396243
/home/everest2/fusionfeastky.com/index.php
#1778396243
/home/everest2/fusionfeastky.com/0zz.php
#1778396243
/home/everest2/fusionfeastky.com/mineragrap.php
#1778396243
/home/everest2/fusionfeastky.com/classwithtostring.php
#1778396243
/home/everest2/fusionfeastky.com/cdn3.php
#1778396243
/home/everest2/fusionfeastky.com/style.php
#1778396243
/home/everest2/ehaatbazar.everestpeakgrowth.com/z12.php
#1778396243
/home/everest2/ehaatbazar.everestpeakgrowth.com/bolt.php
#1778396243
/home/everest2/ehaatbazar.everestpeakgrowth.com/z9.php
#1778396243
/home/everest2/ehaatbazar.everestpeakgrowth.com/123.php
#1778396243
/home/everest2/sepressurewashing.everestpeakgrowth.com/123.zip.php
#1778396243
/home/everest2/sepressurewashing.everestpeakgrowth.com/wp-security.php
#1778396243
/home/everest2/sepressurewashing.everestpeakgrowth.com/index.php
#1778396243
/home/everest2/.trash/wp-blog-header.php
#1778396243
/home/everest2/.trash/wp-security.php
#1778396243
/home/everest2/.trash/mine.php
#1778396243
/home/everest2/.trash/mine2.php
#1778396243
/home/everest2/wilson.everestpeakgrowth.com/wp-securitiy.php
#1778396243
[everest2@s1299 ~]$ rm -f > ~/everestlex.com/cdn3.php > ~/onedaycricketacademy.com/wp-security.php > ~/onedaycricketacademy.com/666.php > ~/onedaycricketacademy.com/vh4.php > ~/onedaycricketacademy.com/mineragrap.php > ~/ninja.everestpeakgrowth.com/wp-security.php > ~/ninja.everestpeakgrowth.com/indexgz.php > ~/ninja.everestpeakgrowth.com/mineragrap.php > ~/ehaatbazar.com/ammika.php > ~/ehaatbazar.com/saiga.php > ~/ehaatbazar.com/zh2.php > ~/ehaatbazar.com/cdn3.php > ~/wrightmarketingteams.com/wp-securitiy.php > ~/wrightmarketingteams.com/cdn3.php > ~/prakash.everestpeakgrowth.com/wp-securitiy.php > ~/fusionfeastky.com/ok.php > ~/fusionfeastky.com/wp-security.php > ~/fusionfeastky.com/ml1.php > ~/fusionfeastky.com/wp-signug.gz.p.php > ~/fusionfeastky.com/0zz.php > ~/fusionfeastky.com/mineragrap.php > ~/fusionfeastky.com/classwithtostring.php > ~/fusionfeastky.com/cdn3.php > ~/fusionfeastky.com/style.php > ~/ehaatbazar.everestpeakgrowth.com/z12.php > ~/ehaatbazar.everestpeakgrowth.com/bolt.php > ~/ehaatbazar.everestpeakgrowth.com/z9.php > ~/ehaatbazar.everestpeakgrowth.com/123.php > ~/sepressurewashing.everestpeakgrowth.com/123.zip.php > ~/sepressurewashing.everestpeakgrowth.com/wp-security.php > ~/wilson.everestpeakgrowth.com/wp-securitiy.php > ~/.trash/wp-blog-header.php > ~/.trash/wp-security.php > ~/.trash/mine2.php
#1778396243
[everest2@s1299 ~]$ head -10 ~/onedaycricketacademy.com/index.php
#1778396243
<?php
#1778396243
#1778396243
/**
#1778396243
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
[everest2@s1299 ~]$ head -10 ~/ninja.everestpeakgrowth.com/index.php
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
#1778396243
* wp-blog-header.php which does and tells WordPress to load the theme.
#1778396243
*
#1778396243
* @package WordPress
#1778396243
*/
#1778396243
[everest2@s1299 ~]$ head -10 ~/fusionfeastky.com/index.php
#1778396243
[everest2@s1299 ~]$ head -10 ~/sepressurewashing.everestpeakgrowth.com/index.php
#1778396243
<?php
#1778396243
#1778396243
/**
#1778396243
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
[everest2@s1299 ~]$ for domain in onedaycricketacademy.com ninja.everestpeakgrowth.com sepressurewashing.everestpeakgrowth.com; do
> cat > ~/$domain/index.php << 'EOF'
> <?php
> /**
> * Front to the WordPress application. This file doesn't do anything, but loads
#1778396243
> * wp-blog-header.php which does and tells WordPress to load the theme.
#1778396243
> *
#1778396243
> * @package WordPress
#1778396243
> */
#1778396243
>
#1778396243
> define( 'WP_USE_THEMES', true );
#1778396243
>
#1778396243
> /** Loads the WordPress Environment and Template */
#1778396243
> require( dirname( __FILE__ ) . '/wp-blog-header.php' );
#1778396243
> EOF
#1778396243
> done
#1778396243
[everest2@s1299 ~]$ head -5 ~/onedaycricketacademy.com/index.php
#1778396243
<?php
#1778396243
/**
#1778396243
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
[everest2@s1299 ~]$ head -5 ~/ninja.everestpeakgrowth.com/index.php
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
#1778396243
* wp-blog-header.php which does and tells WordPress to load the theme.
#1778396243
*
#1778396243
[everest2@s1299 ~]$ head -5 ~/sepressurewashing.everestpeakgrowth.com/index.php
#1778396243
<?php
#1778396243
/**
#1778396243
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
[everest2@s1299 ~]$ find ~ -maxdepth 2 -name "*+49*" -type d 2>/dev/null
[everest2@s1299 ~]$ ls -la ~/onedaycricketacademy.com/mine.php
-rw------- 1 root root 0 May 7 16:54 /home/everest2/onedaycricketacademy.com/mine.php
[everest2@s1299 ~]$ head -10 ~/onedaycricketacademy.com/index.php
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
#1778396243
* wp-blog-header.php which does and tells WordPress to load the theme.
#1778396243
*
#1778396243
* @package WordPress
#1778396243
*/
#1778396243
define( 'WP_USE_THEMES', true );
#1778396243
[everest2@s1299 ~]$ head -10 ~/ninja.everestpeakgrowth.com/index.php
#1778396243
<?php
#1778396243
/**
#1778396243
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
define( 'WP_USE_THEMES', true );
[everest2@s1299 ~]$ head -10 ~/fusionfeastky.com/index.php
[everest2@s1299 ~]$ head -10 ~/sepressurewashing.everestpeakgrowth.com/index.php
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
#1778396243
* wp-blog-header.php which does and tells WordPress to load the theme.
#1778396243
*
#1778396243
* @package WordPress
#1778396243
*/
#1778396243
define( 'WP_USE_THEMES', true );
#1778396368
[everest2@s1299 ~]$head -10 ~/qualitydentalcare.com.np/index.php
#1778396376
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib\|acidpoll" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="updraftplus" 2>/dev/null
#1778396653
rm -f ~/everestlex.com/cdn2.php ~/qualitydentalcare.com.np/ml1.php ~/qualitydentalcare.com.np/zh2.php ~/qualitydentalcare.com.np/vh4.php ~/qualitydentalcare.com.np/cdn3.php ~/wrightmarketingteams.com/public/1lv.php
#1778396664
rm -rf ~/dibyanshdental.everestpeakgrowth.com/wp-content/plugins/duplicate-posttt/
#1778396664
rm -rf ~/dibyanshdental.everestpeakgrowth.com/wp-content/plugins/contact-form-77/
#1778396666
rm -rf ~/padmnadental.everestpeakgrowth.com/wp-content/plugins/duplicate-posttt/
#1778396675
head -10 ~/dibyanshdental.everestpeakgrowth.com/wp-content/plugins/wc-price-history/app/PriorPrice/SettingAir.php
#1778396688
head -10 ~/qualitydentalcare.com.np/index.php
#1778396732
rm -rf ~/dibyanshdental.everestpeakgrowth.com/wp-content/plugins/wc-price-history/
#1778396741
cat > ~/qualitydentalcare.com.np/index.php << 'EOF'
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
EOF
#1778396749
find ~ -name "db.sql.gz" 2>/dev/null
#1778396756
find ~ -name "*.sql.gz" 2>/dev/null
#1778396765
rm -f ~/dibyanshdental.everestpeakgrowth.com/db.sql.gz
#1778396771
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib\|curl_init\|acidpoll" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="updraftplus" 2>/dev/null
#1778396862
rm -f ~/qualitydentalcare.com.np/rg0.php
#1778396862
rm -f ~/fusionfeastky.com/wp-content/themes/lunv.php
#1778396862
rm -f ~/ehaatbazar.com/52d14a/index.php
#1778396862
rm -rf ~/dentalmockupmain.everestpeakgrowth.com/wp-content/themes/dental/parts/ChaCha20/
#1778396865
rm -rf ~/bigriver.everestpeakgrowth.com/more-information/
#1778396873
rm -rf ~/.trash/
#1778396881
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib\|eval(urldecode" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="vendor" --exclude-dir="updraftplus" 2>/dev/null
#1778396990
head -20 ~/ehaatbazar.com/wp-content/plugins/all-in-one-wp-migration/functions.php
#1778397094
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib://\|eval(urldecode\|eval(base64_decode\|gzinflate\|str_rot13" ~ --include="*.php" --exclude-dir="vendor" --exclude-dir="updraftplus" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="all-in-one-wp-migration" --exclude-dir="guzzlehttp" --exclude-dir="monolog" 2>/dev/null
#1778397111
find ~ -maxdepth 2 -name "*.php" -mtime -90 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/wp-content/plugins/*" -not -path "*/wp-content/themes/*" -not -path "*/vendor/*" -not -path "*/uploads/*" 2>/dev/null
#1778397120
find ~ -maxdepth 3 -name "*+49*" -o -name "SecretStream" -o -name "ChaCha20" 2>/dev/null
#1778397171
rm -f ~/everestlex.com/cdn3.php ~/onedaycricketacademy.com/wp-security.php ~/onedaycricketacademy.com/666.php ~/onedaycricketacademy.com/vh4.php ~/onedaycricketacademy.com/mineragrap.php ~/ninja.everestpeakgrowth.com/wp-security.php ~/ninja.everestpeakgrowth.com/indexgz.php ~/ninja.everestpeakgrowth.com/mineragrap.php ~/ehaatbazar.com/buy.php ~/ehaatbazar.com/ammika.php ~/ehaatbazar.com/saiga.php ~/ehaatbazar.com/zh2.php ~/ehaatbazar.com/cdn3.php ~/wrightmarketingteams.com/wp-securitiy.php ~/wrightmarketingteams.com/cdn3.php ~/prakash.everestpeakgrowth.com/wp-securitiy.php ~/fusionfeastky.com/ok.php ~/fusionfeastky.com/wp-security.php ~/fusionfeastky.com/ml1.php ~/fusionfeastky.com/wp-signug.gz.p.php ~/fusionfeastky.com/0zz.php ~/fusionfeastky.com/mineragrap.php ~/fusionfeastky.com/classwithtostring.php ~/fusionfeastky.com/cdn3.php ~/fusionfeastky.com/style.php ~/ehaatbazar.everestpeakgrowth.com/z12.php ~/ehaatbazar.everestpeakgrowth.com/bolt.php ~/ehaatbazar.everestpeakgrowth.com/z9.php ~/ehaatbazar.everestpeakgrowth.com/123.php ~/sepressurewashing.everestpeakgrowth.com/123.zip.php ~/sepressurewashing.everestpeakgrowth.com/wp-security.php ~/wilson.everestpeakgrowth.com/wp-securitiy.php
#1778397184
head -10 ~/ehaatbazar.com/index.php
#1778397279
cat > ~/ehaatbazar.com/index.php << 'EOF'
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
EOF
#1778397361
ls -la ~/ehaatbazar.com/index.php
#1778397364
ls -la ~/ehaatbazar.com/ | head -20
#1778397408
chmod 644 ~/ehaatbazar.com/index.php
#1778397410
chmod 644 ~/ehaatbazar.com/.htaccess
#1778397416
ls ~/ehaatbazar.com/91eba/
#1778397416
ls ~/ehaatbazar.com/52d14a/
#1778397419
ls -la ~/ehaatbazar.com/commentsos/
#1778397429
find ~ -user root 2>/dev/null
#1778398487
rm -f ~/ehaatbazar.com/wp-includes/Requests/library/wp-ainefghdu.php
#1778398487
rm -f ~/ehaatbazar.com/wp-admin/css/colors/blue/wp-adminefc.php
#1778398487
rm -f ~/susmita3.everestpeakgrowth.com/.well-known/acme-challenge/category.template.1776866338.php
#1778398487
rm -f ~/wrightmarketingteams.com/public/lu4.php
#1778398487
rm -f ~/wrightmarketingteams.com/public/vh4.php
#1778398487
rm -f ~/wrightmarketingteams.com/public/rg0.php
#1778398487
rm -f ~/wrightmarketingteams.com/public/cdn3.php
#1778398487
rm -f ~/wrightmarketingteams.com/public/classwithtostring.php
#1778398487
rm -f "~/wrightmarketingteams.com/public/.well-known/acme-challenge/wp-conflg.php"
#1778398487
rm -f ~/wrightmarketingteams.com/public/nt.txt
#1778398487
rm -rf ~/ehaatbazar.com/91eba/
#1778398487
rm -rf ~/onedaycricketacademy.com/cgi-binazwer 2>/dev/null
#1778398487
rm -rf ~/onedaycricketacademy.com/wp-includesazwer 2>/dev/null
#1778398487
rm -rf ~/onedaycricketacademy.com/wp-contentazwer 2>/dev/null
#1778398487
rm -rf ~/onedaycricketacademy.com/wp-adminazwer 2>/dev/null
#1778398487
rm -rf ~/onedaycricketacademy.com/.well-knownazwer 2>/dev/null
#1778398487
rm -rf ~/onedaycricketacademy.com/465454 2>/dev/null
#1778398489
rm -rf ~/padmnadental.everestpeakgrowth.com/wp-content/plugins/wc-price-history
#1778399413
pwd
#1778399413
whoami
#1778399413
php -v
#1778399436
df -h
#1778399456
ls -la public_html
#1778399456
find public_html -name "error_log"
#1778399460
tail -50 public_html/error_log
#1778399504
cd ~/public_html/wp-content/plugins
#1778399509
ls
#1778399556
grep "Version" elementor/elementor.php | head
#1778399556
grep "Version" elementor-pro/elementor-pro.php | head
#1778399556
grep "Version" exclusive-addons-for-elementor/exclusive-addons-for-elementor.php | head
#1778399558
grep "Version" exclusive-addons-elementor-pro/exclusive-addons-elementor-pro.php | head
#1778399567
mv elementor elementor-disabled
#1778399582
mv elementor-pro elementor-pro-disabled
#1778399589
rm -rf ~/public_html/wp-content/cache/*
#1778399590
rm -rf ~/public_html/wp-content/uploads/elementor/css/*
#1778399602
du -sh ~/public_html/* | sort -hr | head
#1778399620
find ~/public_html -type f \( -name "*.zip" -o -name "*.tar" -o -name "*.gz" \) -size +100M
#1778399629
find ~/public_html -type f -mtime -3
#1778399640
find ~/public_html -type f -name "*.php" | xargs grep -l "base64_decode\|gzinflate\|eval("
#1778399757
find ~/public_html -type f -name "*.php" -mtime -7
#1778399884
find ~/public_html -type f -name "*.php" -exec grep -lE "base64_decode|gzinflate|str_rot13|eval\(|shell_exec|system\(|assert\(|preg_replace.*\/e|exec\(|passthru\(|php_uname|chmod\(|mkdir\(|fopen\(|curl_exec" {} \;
#1778400144
rm -rf /home/everest2/ehaatbazar.com/commentsos/
#1778400144
rm -f /home/everest2/onedaycricketacademy.com/mine.php
#1778400144
rm -f /home/everest2/hamrosafetytankycleaning.com/mine.php
#1778400144
rm -rf /home/everest2/onedaycricketacademy.com/cgi-binazwer
#1778400144
rm -rf /home/everest2/onedaycricketacademy.com/wp-includesazwer
#1778400144
rm -rf /home/everest2/onedaycricketacademy.com/wp-contentazwer
#1778400144
rm -rf /home/everest2/onedaycricketacademy.com/wp-adminazwer
#1778400144
rm -f /home/everest2/ehaatbazar.com/wp-includes/Requests/library/wp-ainefghdu.php
#1778400149
rm -f /home/everest2/ehaatbazar.com/wp-admin/css/colors/blue/wp-adminefc.php
#1778400161
find /home/everest2 -type f \( -name "*.php" -o -name "*.phtml" \) | grep -E "shell|mailer|mine|eval|base64|gzinflate"
#1778400238
/home/everest2/wilson.everestpeakgrowth.com/wp-content/themes/twentytwentyfive/assets/shell3.php
#1778400250
rm -f /home/everest2/wilson.everestpeakgrowth.com/wp-content/themes/twentytwentyfive/assets/shell3.php
#1778425479
grep -r "modsec" ~/hamrosafetytankycleaning.com/.htaccess 2>/dev/null
#1778425483
cat ~/hamrosafetytankycleaning.com/.htaccess
#1778425619
rm -f ~/ehaatbazar.com/wp-includes/Requests/library/wp-ainefghdu.php
#1778425619
rm -f ~/ehaatbazar.com/wp-admin/css/colors/blue/wp-adminefc.php
#1778425619
rm -f ~/wrightmarketingteams.com/public/lu4.php
#1778425619
rm -f ~/wrightmarketingteams.com/public/vh4.php
#1778425619
rm -f ~/wrightmarketingteams.com/public/rg0.php
#1778425619
rm -f ~/wrightmarketingteams.com/public/cdn3.php
#1778425619
rm -f ~/wrightmarketingteams.com/public/classwithtostring.php
#1778425619
rm -f "~/wrightmarketingteams.com/public/.well-known/acme-challenge/wp-conflg.php"
#1778425619
rm -rf ~/ehaatbazar.com/91eba/
#1778425624
rm -rf ~/padmnadental.everestpeakgrowth.com/wp-content/plugins/wc-price-history
#1778425736
find ~ -user root 2>/dev/null | grep -v "\.cagefs\|mail\|etc\|softaculous\|et-cache\|updraftplus\|elementor\|wp-reviews"
#1778430039
chmod 755 ~/onedaycricketacademy.com/cgi-binazwer
#1778430039
rm -rf ~/onedaycricketacademy.com/cgi-binazwer
#1778430039
chmod 755 ~/onedaycricketacademy.com/wp-includesazwer
#1778430039
rm -rf ~/onedaycricketacademy.com/wp-includesazwer
#1778430039
chmod 755 ~/onedaycricketacademy.com/wp-contentazwer
#1778430039
rm -rf ~/onedaycricketacademy.com/wp-contentazwer
#1778430039
chmod 755 ~/onedaycricketacademy.com/wp-adminazwer
#1778430039
rm -rf ~/onedaycricketacademy.com/wp-adminazwer
#1778430039
chmod 755 ~/onedaycricketacademy.com/.well-knownazwer
#1778430039
rm -rf ~/onedaycricketacademy.com/.well-knownazwer
#1778430039
chmod 644 ~/ehaatbazar.com/dgc.txt
#1778430039
rm -f ~/ehaatbazar.com/dgc.txt
#1778430039
chmod 755 ~/ehaatbazar.com/commentsos
#1778430039
rm -rf ~/ehaatbazar.com/commentsos
#1778430039
chmod 755 ~/ehaatbazar.com/91eba
#1778430039
rm -rf ~/ehaatbazar.com/91eba
#1778430039
chmod 644 ~/hamrosafetytankycleaning.com/ark.txt
#1778430039
rm -f ~/hamrosafetytankycleaning.com/ark.txt
#1778430039
chmod 755 ~/wrightmarketingteams.com/public/cssNz
#1778430039
rm -rf ~/wrightmarketingteams.com/public/cssNz
#1778430039
chmod 755 ~/wrightmarketingteams.com/public/fontsNz
#1778430040
rm -rf ~/wrightmarketingteams.com/public/fontsNz
#1778430040
chmod 755 ~/padmnadental.everestpeakgrowth.com/wp-content/plugins/wc-price-history
#1778430045
rm -rf ~/padmnadental.everestpeakgrowth.com/wp-content/plugins/wc-price-history
#1778430053
clr
#1778430055
cl
#1779001069
find ~ -maxdepth 2 -name "*.php" -mtime -1 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/wp-content/plugins/*" -not -path "*/wp-content/themes/*" -not -path "*/vendor/*" 2>/dev/null
#1779001112
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib://" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="vendor" --exclude-dir="all-in-one-wp-migration" 2>/dev/null
#1779001228
find ~ -maxdepth 3 -name "*.php" -mtime -3 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/wp-content/plugins/*" -not -path "*/wp-content/themes/*" -not -path "*/vendor/*" 2>/dev/null
#1779001246
ls -la ~/public_html/*.php
#1779001253
ls -la ~/everestpeakgrowth.com/*.php 2>/dev/null
#1779002305
chmod 644 ~/public_html/index.php
#1779002314
cat ~/public_html/index.php
#1779002410
find ~ -name "sapp*" 2>/dev/null
#1779002414
find ~ -name "*signon*" 2>/dev/null
#1779002543
find ~ -maxdepth 2 -name "*.php" -mtime -7 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/wp-content/plugins/*" -not -path "*/wp-content/themes/*" -not -path "*/vendor/*" 2>/dev/null
#1779002563
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib://" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="vendor" --exclude-dir="all-in-one-wp-migration" 2>/dev/null
#1779002588
find ~ -user root 2>/dev/null | grep -v "\.cagefs\|mail\|etc\|softaculous\|et-cache\|updraftplus\|elementor\|wp-reviews\|fusionfeastky\|duplicate-post\|kirki\|rank-math\|gosmtp\|wp-whatsapp\|hamrosafetytankycleaning\|susmita3\|onedaycricketacademy.everestpeakgrowth\|foodtruck\|pwlexingtonky\|ehaatbazar.everestpeakgrowth\|perrinelawncare\|cl.selector"
#1779005089
ls -la
#1780926935
find ~ -maxdepth 2 -name "*.php" -mtime -7 -not -path "*/wp-includes/*" -not -path "*/wp-admin/*" -not -path "*/wp-content/plugins/*" -not -path "*/wp-content/themes/*" -not -path "*/vendor/*" 2>/dev/null
#1780926946
grep -rl "haxorcloud\|zip://x.zip\|compress.zlib://" ~ --include="*.php" --exclude-dir="wp-includes" --exclude-dir="wp-admin" --exclude-dir="vendor" --exclude-dir="all-in-one-wp-migration" --exclude-dir="updraftplus" 2>/dev/null
#1780926977
find ~ -user root 2>/dev/null | grep -v "\.cagefs\|mail\|etc\|softaculous\|et-cache\|updraftplus\|elementor\|wp-reviews\|fusionfeastky\|kirki\|rank-math\|gosmtp\|wp-whatsapp\|duplicate-post"