Gecko [ empowernetkenya.org ]

Name	Size	Permission
.wp-cli	[ DIR ]	drwxr-xr-x
123click	[ DIR ]	drwx---r-x
TF89388	[ DIR ]	drwx---r-x
blueversion	[ DIR ]	drwxr-xr-x
blueversionx	[ DIR ]	drwxr-xr-x
chatblueversion	[ DIR ]	drwx---r-x
colorkeysstudio	[ DIR ]	drwx---r-x
empowernetkenyajuly2026	[ DIR ]	drwx---r-x
genieprevention	[ DIR ]	drwxr-xr-x
geniouskin	[ DIR ]	drwx---r-x
josholurinfr	[ DIR ]	drwx---r-x
lauvia	[ DIR ]	drwx---r-x
login	[ DIR ]	drwx---r-x
maze	[ DIR ]	drwx---r-x
middletvnew	[ DIR ]	drwx---r-x
middletvnew26	[ DIR ]	drwx---r-x
pickapp	[ DIR ]	drwx---r-x
ptitsanes	[ DIR ]	drwxr-xr-x
quaadraa	[ DIR ]	drwx---r-x
security-scan	[ DIR ]	drwxr-xr-x
ssl	[ DIR ]	drwxr-xr-x
.bash_history	48.73 KB	-rw-------
.bash_logout	24 B	-rw-r--r--
.bash_profile	236 B	-rw-r--r--
.bashrc	131 B	-rw-r--r--
.mad-root	0 B	-rw-r--r--
.ovhconfig	110 B	-rw-r--r--
[	0 B	-rw-r--r--
adminer.php	0 B	-rw-r--r--
do	0 B	-rw-r--r--
done	0 B	-rw-r--r--
echo	0 B	-rw-r--r--
execflag=NO	0 B	-rw-r--r--
grep	0 B	-rw-r--r--
obf=NO	0 B	-rw-r--r--
pwnkit	0 B	-rwxr-xr-x
upload=NO	0 B	-rw-r--r--
www-delete-errors.txt	0 B	-rw-r--r--

Code Editor : .bash_history

NO   NO   NO     175649  /home/verseaumee/zenit/administrator/components/com_hikashop/classes/product.php
#1789489248
NO   NO   NO      25379  /home/verseaumee/zenit/administrator/components/com_hikashop/controllers/product.php
#1789489248
NO   NO   NO       9790  /home/verseaumee/zenit/administrator/components/com_hikashop/controllers/plugins.php
#1789489248
NO   NO   NO       1887  /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/tables/item.php
#1789489248
NO   NO   NO       3729  /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/models/item.php
#1789489248
NO   NO   NO       2334  /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/controllers/item.php
#1789489248
NO   NO   NO        511  /home/verseaumee/zenit/administrator/components/com_plugins/helpers/plugins.php
#1789489248
NO   NO   NO        249  /home/verseaumee/josholurinfr/wp-admin/network/plugins.php
#1789489248
NO   NO   NO      30744  /home/verseaumee/josholurinfr/wp-admin/plugins.php
#1789489248
NO   YES  NO       5203  /home/verseaumee/josholurinfr/wp-includes/Text/Diff/Engine/shell.php
#1789489248
NO   NO   NO       2241  /home/verseaumee/josholurinfr/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php
#1789489248
NO   NO   NO        209  /home/verseaumee/josholurinfr/wp-content/plugins/jetpack/_inc/lib/plugins.php
#1789489248
NO   NO   NO       5244  /home/verseaumee/josholurinfr/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php
#1789489248
NO   NO   NO       2016  /home/verseaumee/josholurinfr/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489248
NO   NO   NO        302  /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489248
NO   NO   NO       1687  /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489248
NO   NO   NO        559  /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489248
NO   NO   NO      30744  /home/verseaumee/lauvia/wp-admin/plugins.php
#1789489248
NO   NO   NO        249  /home/verseaumee/lauvia/wp-admin/network/plugins.php
#1789489248
NO   NO   NO        910  /home/verseaumee/lauvia/wp-content/plugins/the-events-calendar/src/views/v2/components/subscribe-links/item.php
#1789489248
NO   NO   NO       1382  /home/verseaumee/lauvia/wp-content/plugins/the-events-calendar/src/views/v2/components/events-bar/views/list/item.php
#1789489248
NO   NO   NO       2016  /home/verseaumee/lauvia/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489248
NO   NO   NO        302  /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489248
NO   NO   NO        559  /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489248
NO   NO   NO       1687  /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489248
NO   NO   NO      20022  /home/verseaumee/lauvia/wp-content/plugins/trx_updater/core/update/plugins.php
#1789489249
NO   NO   NO       2664  /home/verseaumee/lauvia/wp-content/plugins/instagram-feed/templates/item.php
#1789489249
NO   YES  NO       5203  /home/verseaumee/lauvia/wp-includes/Text/Diff/Engine/shell.php
#1789489249
NO   NO   NO        558  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489249
NO   NO   NO       1686  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489249
NO   NO   NO        300  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489249
NO   NO   NO        313  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php
#1789489249
NO   NO   NO       1028  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php
#1789489249
NO   NO   NO       2383  /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php
#1789489249
NO   NO   NO       2019  /home/verseaumee/middletvnew/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489249
NO   YES  NO       5203  /home/verseaumee/middletvnew/wp-includes/Text/Diff/Engine/shell.php
#1789489249
NO   NO   NO      30724  /home/verseaumee/middletvnew/wp-admin/plugins.php
#1789489249
NO   NO   NO        249  /home/verseaumee/middletvnew/wp-admin/network/plugins.php
#1789489249
NO   NO   NO      30724  /home/verseaumee/blueversion/wp-admin/plugins.php
#1789489249
NO   NO   NO        249  /home/verseaumee/blueversion/wp-admin/network/plugins.php
#1789489249
NO   NO   NO       1863  /home/verseaumee/blueversion/wp-content/themes/motors/admin/templates/plugins.php
#1789489249
NO   NO   NO       1565  /home/verseaumee/blueversion/wp-content/plugins/cyberdom-core/inc/shortcodes/item-showcase/variations/list/templates/parts/item.php
#1789489249
NO   NO   NO       2952  /home/verseaumee/blueversion/wp-content/plugins/instagram-feed/templates/item.php
#1789489249
NO   NO   NO       3680  /home/verseaumee/blueversion/wp-content/plugins/feeds-for-youtube/templates/item.php
#1789489249
NO   NO   NO       5244  /home/verseaumee/blueversion/wp-content/plugins/elementorpro3171n/modules/woocommerce/documents/product.php
#1789489249
NO   NO   NO      16937  /home/verseaumee/blueversion/wp-content/plugins/give/includes/admin/plugins.php
#1789489249
NO   NO   NO        492  /home/verseaumee/blueversion/wp-content/plugins/envato-market/inc/admin/view/partials/plugins.php
#1789489249
NO   NO   NO       2327  /home/verseaumee/blueversion/wp-content/plugins/custom-twitter-feeds/templates/item.php
#1789489249
NO   NO   NO       2016  /home/verseaumee/blueversion/wp-content/plugins/elementorx/modules/system-info/reporters/plugins.php
#1789489249
NO   NO   NO        302  /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/revert/plugins.php
#1789489249
NO   NO   NO        559  /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/export/plugins.php
#1789489249
NO   NO   NO       1687  /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/import/plugins.php
#1789489249
NO   NO   NO        302  /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489249
NO   NO   NO       1687  /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489249
NO   NO   NO        559  /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489250
NO   NO   NO       2016  /home/verseaumee/blueversion/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489250
NO   NO   NO        911  /home/verseaumee/blueversion/wp-content/plugins/wpforms/templates/builder/payment/recurring/item.php
#1789489250
NO   NO   NO       1119  /home/verseaumee/blueversion/wp-content/plugins/wpforms/includes/functions/plugins.php
#1789489250
NO   NO   NO       5244  /home/verseaumee/blueversion/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php
#1789489250
NO   NO   NO        435  /home/verseaumee/blueversion/wp-content/plugins/complianz-gdpr/settings/config/fields/wizard/plugins.php
#1789489250
NO   NO   NO       1199  /home/verseaumee/blueversion/wp-content/plugins/wc-donation-platform/includes/wc-templates/single-product/add-to-cart/product.php
#1789489250
NO   NO   NO       1843  /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/admin/inc/admin-pages/sub-pages/widgets/templates/item.php
#1789489250
NO   NO   NO        850  /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/business-hours/variations/standard/templates/item.php
#1789489250
NO   NO   NO       1112  /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/pricing-list/variations/standard/templates/item.php
#1789489250
NO   NO   NO       1162  /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/pricing-list/variations/image-before/templates/item.php
#1789489250
NO   YES  NO       5203  /home/verseaumee/blueversion/wp-includes/Text/Diff/Engine/shell.php
#1789489250
NO   NO   NO      30744  /home/verseaumee/maze/wp-admin/plugins.php
#1789489250
NO   NO   NO        249  /home/verseaumee/maze/wp-admin/network/plugins.php
#1789489250
NO   YES  NO       5203  /home/verseaumee/maze/wp-includes/Text/Diff/Engine/shell.php
#1789489250
NO   NO   NO        209  /home/verseaumee/maze/wp-content/plugins/jetpack/_inc/lib/plugins.php
#1789489250
NO   NO   NO       2241  /home/verseaumee/maze/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php
#1789489250
NO   NO   NO       2019  /home/verseaumee/maze/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489250
NO   NO   NO        313  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php
#1789489250
NO   NO   NO       2383  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php
#1789489250
NO   NO   NO       1028  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php
#1789489250
NO   NO   NO        300  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489250
NO   NO   NO        558  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489250
NO   NO   NO       1686  /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489250
YES  YES  NO       1758  /home/verseaumee/genieprevention/product.php
#1789489250
NO   NO   NO      25579  /home/verseaumee/genieprevention/templates/bizone/html/com_k2/templates/default/item.php
#1789489250
YES  NO   NO      54169  /home/verseaumee/genieprevention/witmmm.php
#1789489251
NO   NO   NO       1248  /home/verseaumee/genieprevention/layouts/joomla/html/batch/item.php
#1789489251
NO   NO   NO        307  /home/verseaumee/genieprevention/components/com_k2/views/item/tmpl/item.php
#1789489251
NO   NO   NO      11065  /home/verseaumee/genieprevention/components/com_k2/controllers/item.php
#1789489251
NO   NO   NO      28882  /home/verseaumee/genieprevention/components/com_k2/templates/default/item.php
#1789489251
NO   NO   NO      68200  /home/verseaumee/genieprevention/components/com_k2/models/item.php
#1789489251
NO   NO   NO       4324  /home/verseaumee/genieprevention/libraries/joomla/form/fields/plugins.php
#1789489251
NO   NO   NO       2483  /home/verseaumee/genieprevention/libraries/f0f/form/field/plugins.php
#1789489251
NO   NO   NO       2483  /home/verseaumee/genieprevention/libraries/fof/form/field/plugins.php
#1789489251
YES  YES  NO       1758  /home/verseaumee/genieprevention/item.php
#1789489251
YES  YES  NO       1758  /home/verseaumee/genieprevention/click.php
#1789489251
NO   NO   NO       3424  /home/verseaumee/genieprevention/administrator/components/com_plugins/helpers/plugins.php
#1789489251
NO   NO   NO        611  /home/verseaumee/genieprevention/administrator/components/com_plugins/plugins.php
#1789489251
NO   NO   NO        883  /home/verseaumee/genieprevention/administrator/components/com_plugins/controllers/plugins.php
#1789489251
NO   NO   NO       7989  /home/verseaumee/genieprevention/administrator/components/com_plugins/models/plugins.php
#1789489251
NO   NO   NO       1196  /home/verseaumee/genieprevention/administrator/components/com_privacy/helpers/export/item.php
#1789489251
NO   NO   NO       3350  /home/verseaumee/genieprevention/administrator/components/com_jce/helpers/plugins.php
#1789489251
NO   NO   NO      15868  /home/verseaumee/genieprevention/administrator/components/com_jce/models/plugins.php
#1789489251
YES  NO   NO      16316  /home/verseaumee/genieprevention/administrator/components/com_menus/controllers/item.php
#1789489251
NO   NO   NO      43673  /home/verseaumee/genieprevention/administrator/components/com_menus/models/item.php
#1789489251
NO   NO   NO      47482  /home/verseaumee/genieprevention/administrator/components/com_k2/models/item.php
#1789489251
NO   NO   NO       2728  /home/verseaumee/genieprevention/administrator/components/com_k2/controllers/item.php
#1789489251
NO   NO   NO       3256  /home/verseaumee/genieprevention/administrator/components/com_k2/elements/item.php
#1789489251
YES  YES  NO       1823  /home/verseaumee/genieprevention/plugins.php
#1789489251
NO   NO   NO      30744  /home/verseaumee/blueversionx/wp-admin/plugins.php
#1789489251
NO   NO   NO        249  /home/verseaumee/blueversionx/wp-admin/network/plugins.php
#1789489251
NO   YES  NO       5203  /home/verseaumee/blueversionx/wp-includes/Text/Diff/Engine/shell.php
#1789489251
NO   NO   NO       1382  /home/verseaumee/blueversionx/wp-content/plugins/the-events-calendar/src/views/v2/components/events-bar/views/list/item.php
#1789489252
NO   NO   NO        910  /home/verseaumee/blueversionx/wp-content/plugins/the-events-calendar/src/views/v2/components/subscribe-links/item.php
#1789489252
NO   NO   NO       2664  /home/verseaumee/blueversionx/wp-content/plugins/instagram-feed/templates/item.php
#1789489252
NO   NO   NO      20022  /home/verseaumee/blueversionx/wp-content/plugins/trx_updater/core/update/plugins.php
#1789489252
NO   NO   NO       2016  /home/verseaumee/blueversionx/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489252
NO   NO   NO       1687  /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489252
NO   NO   NO        559  /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489252
NO   NO   NO        302  /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489252
NO   NO   NO        598  /home/verseaumee/ptitsanes/administrator/components/com_plugins/plugins.php
#1789489252
NO   NO   NO        870  /home/verseaumee/ptitsanes/administrator/components/com_plugins/controllers/plugins.php
#1789489252
NO   NO   NO       3410  /home/verseaumee/ptitsanes/administrator/components/com_plugins/helpers/plugins.php
#1789489252
NO   NO   NO       7976  /home/verseaumee/ptitsanes/administrator/components/com_plugins/models/plugins.php
#1789489252
NO   NO   NO       1183  /home/verseaumee/ptitsanes/administrator/components/com_privacy/helpers/export/item.php
#1789489252
YES  NO   NO      16303  /home/verseaumee/ptitsanes/administrator/components/com_menus/controllers/item.php
#1789489252
NO   NO   NO      43814  /home/verseaumee/ptitsanes/administrator/components/com_menus/models/item.php
#1789489252
NO   NO   NO       1231  /home/verseaumee/ptitsanes/layouts/joomla/html/batch/item.php
#1789489252
NO   NO   NO       2483  /home/verseaumee/ptitsanes/libraries/fof/form/field/plugins.php
#1789489252
NO   NO   NO       4311  /home/verseaumee/ptitsanes/libraries/joomla/form/fields/plugins.php
#1789489252
NO   YES  NO       5203  /home/verseaumee/geniouskin/wp-includes/Text/Diff/Engine/shell.php
#1789489252
NO   NO   NO      30724  /home/verseaumee/geniouskin/wp-admin/plugins.php
#1789489252
NO   NO   NO        249  /home/verseaumee/geniouskin/wp-admin/network/plugins.php
#1789489252
NO   NO   NO        558  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489252
NO   NO   NO       1686  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489252
NO   NO   NO        300  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489252
NO   NO   NO        313  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php
#1789489252
NO   NO   NO       2383  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php
#1789489252
NO   NO   NO       1028  /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php
#1789489252
NO   NO   NO       2019  /home/verseaumee/geniouskin/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489252
NO   NO   NO        249  /home/verseaumee/colorkeysstudio/wp-admin/network/plugins.php
#1789489252
NO   NO   NO      30744  /home/verseaumee/colorkeysstudio/wp-admin/plugins.php
#1789489253
NO   YES  NO       5203  /home/verseaumee/colorkeysstudio/wp-includes/Text/Diff/Engine/shell.php
#1789489253
NO   NO   NO       5244  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php
#1789489253
NO   NO   NO       2019  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489253
NO   NO   NO       1686  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489253
NO   NO   NO        558  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489253
NO   NO   NO        300  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489253
NO   NO   NO       1028  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php
#1789489253
NO   NO   NO       2383  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php
#1789489253
NO   NO   NO        313  /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php
#1789489253
NO   NO   NO       2241  /home/verseaumee/colorkeysstudio/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php
#1789489253
NO   NO   NO        209  /home/verseaumee/colorkeysstudio/wp-content/plugins/jetpack/_inc/lib/plugins.php
#1789489253
NO   NO   NO        249  /home/verseaumee/empowernetkenyajuly2026/wp-admin/network/plugins.php
#1789489253
NO   NO   NO      30744  /home/verseaumee/empowernetkenyajuly2026/wp-admin/plugins.php
#1789489253
NO   NO   NO      17010  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/give/includes/admin/plugins.php
#1789489253
NO   NO   NO        559  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489253
NO   NO   NO       1687  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489253
NO   NO   NO        302  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489253
NO   NO   NO       2016  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489253
NO   NO   NO       1119  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/wpforms/includes/functions/plugins.php
#1789489253
NO   NO   NO        911  /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/wpforms/templates/builder/payment/recurring/item.php
#1789489253
NO   YES  NO       5203  /home/verseaumee/empowernetkenyajuly2026/wp-includes/Text/Diff/Engine/shell.php
#1789489253
NO   NO   NO      17374  /home/verseaumee/TF89388/wp-content/plugins/newsletter/includes/mailer.php
#1789489253
NO   YES  NO       5210  /home/verseaumee/TF89388/wp-includes/Text/Diff/Engine/shell.php
#1789489253
NO   NO   NO      30744  /home/verseaumee/middletvnew26/wp-admin/plugins.php
#1789489253
NO   NO   NO        249  /home/verseaumee/middletvnew26/wp-admin/network/plugins.php
#1789489253
NO   NO   NO       2019  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php
#1789489253
NO   NO   NO       1028  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php
#1789489253
NO   NO   NO       2383  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php
#1789489253
NO   NO   NO        313  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php
#1789489254
NO   NO   NO        558  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php
#1789489254
NO   NO   NO       1686  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php
#1789489254
NO   NO   NO        300  /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php
#1789489283
NO   YES  NO       5203  /home/verseaumee/middletvnew26/wp-includes/Text/Diff/Engine/shell.php
#1789489285
while IFS= read -r f; do     [ -f "$f" ] || continue     obf="NO";     execflag="NO";     upload="NO"     grep -aqE 'base64_decode|gzinflate|str_rot13|eval[[:space:]]*\(' "$f" && obf="YES";     grep -aqE 'shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|proc_open|popen|curl_exec' "$f" && execflag="YES";     grep -aqE 'move_uploaded_file|file_put_contents|chmod[[:space:]]*\(' "$f" && upload="YES"     echo "--------------------------------";     echo "$f";     echo "SIZE: $(wc -c < "$f")";     echo "SHA256: $(sha256sum "$f" | cut -d' ' -f1)";     echo "OBF=$obf EXEC=$execflag UPLOAD=$upload" done < /home/verseaumee/security-scan/reports/root-shell-candidates.txt
#1789489317
sha256sum /home/verseaumee/zenit/product.php
#1789489460
mkdir -p /home/verseaumee/security-scan/reports
#1789489461
mkdir -p /home/verseaumee/security-scan/quarantine
#1789489467
rm -f /home/verseaumee/zenit/product.php
#1789489626
rm -f /home/verseaumee/zenit/product.php
#1789489628
chmod -R u+rwX /home/verseaumee/zenit 2>/dev/null
#1789489659
rm -rf -- /home/verseaumee/zenit
#1789489680
if [ -e /home/verseaumee/zenit ]; then     echo "ZENIT STILL EXISTS"; else     echo "ZENIT PERMANENTLY DELETED"; fi
#1789489740
chmod -R u+rwX /home/verseaumee/www 2>/dev/null
#1789489759
if [ -e /home/verseaumee/www ]; then     echo "WWW STILL EXISTS"; else     echo "WWW PERMANENTLY DELETED"; fi
#1789489781
if [ -e /home/verseaumee/www ]; then     echo "WWW STILL EXISTS"; else     echo "WWW PERMANENTLY DELETED"; fi
#1789489826
rm -rf -- /home/verseaumee/www 2> /home/verseaumee/www-delete-errors.txt
#1789489846
if [ -e /home/verseaumee/www ]; then     echo "WWW STILL EXISTS";     echo "Remaining items:";     find /home/verseaumee/www -maxdepth 2 -print 2>/dev/null | head -50;     echo "Delete errors:";     head -50 /home/verseaumee/www-delete-errors.txt; else     echo "WWW PERMANENTLY DELETED"; fi
#1789489914
find /home/verseaumee/www -type d -exec chmod u+rwx {} + 2>/dev/null
#1789489915
find /home/verseaumee/www -type f -exec chmod u+rw {} + 2>/dev/null
#1789489951
rm -rf -- /home/verseaumee/www
#1789489963
test ! -e /home/verseaumee/www && echo "WWW PERMANENTLY DELETED" || echo "WWW STILL EXISTS"
#1789490016
chmod u+w /home/verseaumee/genieprevention
#1789490031
tar -czf /home/verseaumee/security-scan/quarantine/genie-root-malware.tar.gz /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php
#1789490052
rm -f /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php
#1789490059
for f in /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php; do     [ -e "$f" ] && echo "STILL EXISTS: $f"; done
#1789490085
grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*\([[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null > /home/verseaumee/security-scan/reports/fresh-malware-scan.txt
#1789490243
wc -l /home/verseaumee/security-scan/reports/fresh-malware-scan.txt
#1789490297
cat /home/verseaumee/security-scan/reports/fresh-malware-scan.txt
#1789490301
f="$(cat /home/verseaumee/security-scan/reports/fresh-malware-scan.txt)"
#1789490301
echo "$f"
#1789490301
sha256sum "$f"
#1789490301
wc -c "$f"
#1789490307
grep -aoEi 'base64_decode|gzinflate|str_rot13|eval|assert|system|shell_exec|passthru|exec|proc_open|popen|curl_exec|file_put_contents|move_uploaded_file|chmod|php_uname|FilesMan|WSO' "$f" | sort -u
#1789490336
echo "$f"
#1789490341
sha256sum "$f"
#1789490347
wc -c "$f"
#1789490382
tar -czf /home/verseaumee/security-scan/quarantine/last-malware-index.tar.gz /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php
#1789490387
rm -f /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php
#1789490393
chmod u+w /home/verseaumee/genieprevention/libraries/joomla/github/package/issues
#1789490400
rm -f /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php
#1789490407
grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*$[[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null > /home/verseaumee/security-scan/reports/fresh-malware-scan.txt
#1789490522
wc -l /home/verseaumee/security-scan/reports/fresh-malware-scan.txt
#1789490570
grep -RIn --exclude-dir=security-scan --include=".user.ini" --include="php.ini" --include=".htaccess" -E 'auto_prepend_file|auto_append_file|base64_decode|gzinflate|shell_exec|passthru|eval\(|php_value[[:space:]]+auto_' /home/verseaumee 2>/dev/null
#1789490679
crontab -l 2>/dev/null
#1789490687
ls -la /home/verseaumee/.ssh 2>/dev/null
#1789490693
cat /home/verseaumee/.ssh/authorized_keys 2>/dev/null
#1789490699
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f \( -name "*.php" -o -name ".htaccess" -o -name ".user.ini" $ -mtime -7 -printf "%TY-%Tm-%Td %TH:%TM %p\n" 2>/dev/null | sort -r | head -100
#1789490793
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f $ -name 'worksec.php' -o -name 'wp-editor.php' -o -name 'wp-theme.php' -o -name 'lock360.php' -o -name 'wp-content-css.php' $ -print 2>/dev/null
#1789490883
ls -la /home/verseaumee/.ssh 2>/dev/null
#1789490883
cat /home/verseaumee/.ssh/authorized_keys 2>/dev/null
#1789490890
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f $ -name 'worksec.php' -o -name 'wp-editor.php' -o -name 'wp-theme.php' -o -name 'lock360.php' -o -name 'wp-content-css.php' $ -print 2>/dev/null
#1789490933
grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*\([[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null | wc -l
#1789491996
cd /home/verseaumee/security-scan/tools
#1789491996
php wp-cli.phar --info
#1789492052
mkdir -p /home/verseaumee/security-scan/tools
#1789492059
cd /home/verseaumee/security-scan/tools
#1789492065
curl -L -o wp-cli.phar https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
#1789492076
ls -lh wp-cli.phar
#1789492084
php wp-cli.phar --info
#1789492115
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -name 'wp-config.php' -printf '%h\n' 2>/dev/null | sort -u > /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789492375
wc -l /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789492384
cat /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789492432
WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
#1789492432
REPORT=/home/verseaumee/security-scan/reports/wordpress-core-checks.txt
#1789492432
: > "$REPORT"
#1789492432
while IFS= read -r site; do     echo "===== $site =====" | tee -a "$REPORT"     php "$WPCLI"       --path="$site"       core verify-checksums       --include-root       2>&1 | tee -a "$REPORT"     echo "" | tee -a "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789492492
grep -Ei 'warning|error|doesn.t verify|should not exist|checksum|failed' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt
#1789492501
grep -Eic 'warning|error|doesn.t verify|should not exist|checksum|failed' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt
#1789492553
grep -Ei 'Warning:|Error:|doesn.t verify|should not exist' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt | grep -v 'Success:' > /home/verseaumee/security-scan/reports/core-anomalies.txt
#1789492581
wc -l /home/verseaumee/security-scan/reports/core-anomalies.txt
#1789492586
head -80 /home/verseaumee/security-scan/reports/core-anomalies.txt
#1789492601
awk '
/^===== / {site=$0}
/Warning:|Error:|doesn.t verify|should not exist/ {
    if ($0 !~ /Success:/) {
        print site
        print "  " $0
    }
}
' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt > /home/verseaumee/security-scan/reports/core-anomalies-by-site.txt
#1789492610
head -100 /home/verseaumee/security-scan/reports/core-anomalies-by-site.txt
#1789509557
ps -u "$(whoami)" -f | grep '[w]p-cli.phar'
#1789509566
cat > /home/verseaumee/security-scan/repair-wordpress-core.sh <<'EOF'
#!/bin/sh

WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
LIST=/home/verseaumee/security-scan/reports/wordpress-roots.txt

while IFS= read -r site; do
    echo "========================================"
    echo "SITE: $site"

VER=$(grep -m1 "\$wp_version =" "$site/wp-includes/version.php" 2>/dev/null \
        | sed "s/.*'$[^']*$'.*/\1/")

echo "VERSION: $VER"

if [ -n "$VER" ]; then
        php "$WPCLI" core download \
            --path="$site" \
            --version="$VER" \
            --force \
            --skip-content
    else
        echo "SKIPPED - VERSION NOT DETECTED"
    fi

done < "$LIST"

echo "CORE REPAIR FINISHED"
EOF

#1789509580
chmod +x /home/verseaumee/security-scan/repair-wordpress-core.sh
#1789509585
nohup /home/verseaumee/security-scan/repair-wordpress-core.sh > /home/verseaumee/security-scan/reports/core-repair.log 2>&1 &
#1789509606
tail -30 /home/verseaumee/security-scan/reports/core-repair.log
#1789509654
tail -30 /home/verseaumee/security-scan/reports/core-repair.log
#1789509661
grep "CORE REPAIR FINISHED" /home/verseaumee/security-scan/reports/core-repair.log
#1789509668
php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content
#1789509678
php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force \
#1789509755
chmod u+rwx /home/verseaumee/blueversion
#1789509765
test -w /home/verseaumee/blueversion && echo "WRITABLE" || echo "NOT WRITABLE"
#1789509772
php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content
#1789509801
find /home/verseaumee/blueversion/wp-admin      /home/verseaumee/blueversion/wp-includes -type d -exec chmod u+rwx {} + 2>/dev/null
#1789509810
find /home/verseaumee/blueversion/wp-admin      /home/verseaumee/blueversion/wp-includes -type f -exec chmod u+rw {} + 2>/dev/null
#1789509827
tail -40 /home/verseaumee/security-scan/reports/core-repair.log
#1789509875
grep -nE 'SITE:|Error:|SKIPPED|Permission denied|Permission non accordée' /home/verseaumee/security-scan/reports/core-repair.log
#1789509884
WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
#1789509884
while IFS= read -r site; do     OUT=$(php "$WPCLI" --path="$site" core verify-checksums --include-root 2>&1)     BAD=$(printf '%s\n' "$OUT" | grep -Ec "doesn't verify against checksum|doesn't exist");     EXTRA=$(printf '%s\n' "$OUT" | grep -c "File should not exist:")     echo "$site";     echo "  MODIFIED/MISSING: $BAD";     echo "  EXTRA FILES:      $EXTRA"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789510082
WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
#1789510082
php "$WPCLI" --path=/home/verseaumee/colorkeysstudio core verify-checksums --include-root 2>&1 | grep -E "doesn't verify against checksum|doesn't exist"
#1789510163
WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
#1789510164
REPORT=/home/verseaumee/security-scan/reports/plugin-checksums.txt
#1789510164
: > "$REPORT"
#1789510164
while IFS= read -r site; do     echo "===== $site =====" | tee -a "$REPORT"     php "$WPCLI"     --path="$site"     plugin verify-checksums     --all     --strict     --skip-themes     2>&1 | tee -a "$REPORT"     echo "" | tee -a "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789510174
grep -Ei 'Warning:|Error:|doesn.t verify|should not exist|checksum|Could not retrieve|Couldn.t fetch' /home/verseaumee/security-scan/reports/plugin-checksums.txt > /home/verseaumee/security-scan/reports/plugin-anomalies.txt
#1789510182
wc -l /home/verseaumee/security-scan/reports/plugin-anomalies.txt
#1789510190
head -100 /home/verseaumee/security-scan/reports/plugin-anomalies.txt
#1789510252
wc -l /home/verseaumee/security-scan/reports/plugin-checksums.txt
#1789510259
REPORT=/home/verseaumee/security-scan/reports/wp-content-malware-scan.txt
#1789510259
: > "$REPORT"
#1789510259
while IFS= read -r site; do     echo "===== $site =====" >> "$REPORT"     find "$site/wp-content/plugins"          "$site/wp-content/themes"          "$site/wp-content/mu-plugins"          "$site/wp-content/uploads"          -type f          $ -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' $          -print0 2>/dev/null |     xargs -0 -r grep -IlE     'eval[[:space:]]*$[[:space:]]*(base64_decode|gzinflate|str_rot13)|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|system[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|move_uploaded_file[[:space:]]*\([[:space:]]*\$_FILES'     >> "$REPORT" done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789510330
grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | wc -l
#1789510336
grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | wc -l
#1789510346
grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | head -100
#1789510353
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -path '*/wp-content/uploads/*' \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' $ -print 2>/dev/null > /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789510390
wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789510400
REPORT=/home/verseaumee/security-scan/reports/wp-root-malware.txt
#1789510401
: > "$REPORT"
#1789510401
while IFS= read -r site; do     find "$site" -maxdepth 1 -type f     $ -iname '*.php' -o -iname '*.phtml' $     -print0 2>/dev/null |     xargs -0 -r grep -IlE     'eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate|str_rot13)|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|system[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|move_uploaded_file[[:space:]]*\([[:space:]]*\$_FILES'     >> "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789510413
wc -l /home/verseaumee/security-scan/reports/wp-root-malware.txt
#1789510451
cat /home/verseaumee/security-scan/reports/wp-root-malware.txt
#1789510458
while IFS= read -r f; do     echo "===== $f =====";     wc -c "$f";     sha256sum "$f"; done < /home/verseaumee/security-scan/reports/wp-root-malware.txt
#1789510467
wc -l /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt
#1789510474
wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789511392
ls -lh /home/verseaumee/security-scan/reports/php-in-uploads.txt /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt /home/verseaumee/security-scan/reports/wp-root-malware.txt 2>/dev/null
#1789511399
awk -F'\t' '$2=="YES" || $3=="YES" {n++} END {print "SUSPICIOUS UPLOAD PHP:", n+0}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt
#1789511404
echo "NON-INDEX PHP:"
#1789511404
grep -Ev '/index\.php$' /home/verseaumee/security-scan/reports/php-in-uploads.txt | wc -l
#1789511414
awk -F'\t' '$2=="YES" || $3=="YES" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt | head -100
#1789511448
wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789511455
REPORT=/home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt
#1789511455
: > "$REPORT"
#1789511455
while IFS= read -r f; do     [ -f "$f" ] || continue     SIZE=$(wc -c < "$f");     HASH=$(sha256sum "$f" | cut -d' ' -f1)     grep -aqE 'base64_decode|gzinflate|str_rot13|eval[[:space:]]*\(' "$f"         && OBF=YES || OBF=NO     grep -aqE 'shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|proc_open|popen|curl_exec|file_put_contents|move_uploaded_file' "$f"         && DANGER=YES || DANGER=NO     grep -aqE '\$_(POST|GET|REQUEST|FILES|COOKIE)' "$f"         && INPUT=YES || INPUT=NO     printf "%s\t%s\t%s\t%s\t%s\t%s\n"         "$SIZE" "$OBF" "$DANGER" "$INPUT" "$HASH" "$f"         >> "$REPORT" done < /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789511464
awk -F'\t' '$2=="YES" || $3=="YES" {n++} END {print "SUSPICIOUS:", n+0}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt
#1789511469
awk -F'\t' '$2=="YES" || $3=="YES" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt | head -100
#1789511534
awk -F'\t' '$2=="YES" || $3=="YES" {print $6}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt > /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511541
wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511547
Q="/home/verseaumee/security-scan/quarantine/uploads-php-$(date +%Y%m%d-%H%M%S)"
#1789511547
mkdir -p "$Q"
#1789511547
while IFS= read -r f; do     [ -f "$f" ] || continue     REL="${f#/home/verseaumee/}";     DEST="$Q/$REL"     mkdir -p "$(dirname "$DEST")";     chmod u+w "$(dirname "$f")" 2>/dev/null     if mv -- "$f" "$DEST"; then         echo "QUARANTINED: $f";     else         echo "FAILED: $f";     fi; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511558
while IFS= read -r f; do     [ -e "$f" ] && echo "STILL EXISTS: $f"; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511579
wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511589
wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511620
Q="/home/verseaumee/security-scan/quarantine/uploads-php-$(date +%Y%m%d-%H%M%S)"
#1789511620
mkdir -p "$Q"
#1789511620
while IFS= read -r f; do     [ -f "$f" ] || continue     REL="${f#/home/verseaumee/}";     DEST="$Q/$REL"     mkdir -p "$(dirname "$DEST")";     chmod u+w "$(dirname "$f")" 2>/dev/null     if mv -- "$f" "$DEST"; then         echo "QUARANTINED: $f";     else         echo "FAILED: $f";     fi; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511627
while IFS= read -r f; do     [ -e "$f" ] && echo "STILL EXISTS: $f"; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt
#1789511634
awk -F'\t' '$2=="NO" && $3=="NO" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt > /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt
#1789511640
wc -l /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt
#1789511645
cut -f5 /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt | sort | uniq -c | sort -nr | head -20
#1789511654
grep -Ev '/index\.php$' /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt | head -80
#1789511666
cat /home/verseaumee/security-scan/reports/wp-root-malware.txt
#1789511728
f=/home/verseaumee/colorkeysstudio/wp-content/uploads/hp2.php
#1789511728
echo "FILE: $f"
#1789511728
wc -c "$f"
#1789511728
sha256sum "$f"
#1789511728
file "$f"
#1789511728
echo "LONGEST LINE:"
#1789511728
awk '{ if(length>m)m=length } END {print m}' "$f"
#1789511728
echo "SUSPICIOUS TOKENS:"
#1789511728
grep -aoEi 'base64|gzinflate|gzdecode|str_rot13|strrev|hex2bin|pack|chr|eval|assert|system|shell_exec|passthru|exec|proc_open|popen|curl|wget|move_uploaded_file|file_put_contents|unlink|chmod|php_uname|\$_GET|\$_POST|\$_REQUEST|\$_COOKIE|\$_FILES|call_user_func|create_function|openssl_decrypt' "$f" | sort -u
#1789511783
find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -size 33983c -exec sha256sum {} + 2>/dev/null | grep '^c1eda8add9fe6cf5e1be92c89d30bdadb169fe2476f12e937c0cace4c3f0ea1d'
#1789511893
chmod -R u+rwX /home/verseaumee/blueversion
#1789511931
php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content
#1789512002
php /home/verseaumee/security-scan/tools/wp-cli.phar --path=/home/verseaumee/blueversion core verify-checksums --include-root
#1789512096
mkdir -p /home/verseaumee/security-scan/quarantine/blueversion-root
#1789512103
for f in system.php about.php admin.php gtaavijg.php .well-known/q1.php; do   [ -f "/home/verseaumee/blueversion/$f" ] &&   mv "/home/verseaumee/blueversion/$f"      /home/verseaumee/security-scan/quarantine/blueversion-root/; done
#1789512109
chmod -R u+rwX /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes
#1789512117
rm -rf /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes
#1789512125
php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content
#1789512134
php /home/verseaumee/security-scan/tools/wp-cli.phar --path=/home/verseaumee/blueversion core verify-checksums --include-root 2>&1 | grep "File should not exist:"
#1789512207
f=/home/verseaumee/blueversion/config.php
#1789512207
echo "SIZE:"
#1789512207
wc -c "$f"
#1789512207
echo "HASH:"
#1789512207
sha256sum "$f"
#1789512207
echo "TYPE:"
#1789512207
file "$f"
#1789512208
echo "SUSPICIOUS FUNCTIONS:"
#1789512208
grep -aoEi 'base64_decode|gzinflate|eval|assert|system|shell_exec|passthru|exec|curl_exec|file_put_contents|move_uploaded_file|php_uname|preg_replace|str_rot13|proc_open|popen' "$f" | sort -u
#1789512235
stat /home/verseaumee/blueversion/config.php
#1789512244
WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
#1789512244
REPORT=/home/verseaumee/security-scan/reports/plugin-checks.txt
#1789512245
: > "$REPORT"
#1789512245
while IFS= read -r site; do     echo "========================================" | tee -a "$REPORT";     echo "SITE: $site" | tee -a "$REPORT"     php "$WPCLI"       --path="$site"       plugin verify-checksums       --all       --strict       2>&1 | tee -a "$REPORT" done < /home/verseaumee/security-scan/reports/wordpress-roots.txt
#1789512260
grep -Ei 'Warning:|Error:|does not match|doesn.t verify|checksum|not found' /home/verseaumee/security-scan/reports/plugin-checks.txt | head -100
#1789512366
cat > /home/verseaumee/security-scan/full-wp-audit.sh <<'EOF'
#!/bin/sh

WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar
LIST=/home/verseaumee/security-scan/reports/wordpress-roots.txt
R=/home/verseaumee/security-scan/reports

: > "$R/core-final.txt"
: > "$R/root-extras.txt"
: > "$R/plugins-final.txt"
: > "$R/themes-list.txt"
: > "$R/php-in-uploads.txt"
: > "$R/content-high-confidence.txt"
: > "$R/disguised-php.txt"

while IFS= read -r site; do

echo "========================================"
    echo "SCANNING: $site"

echo "===== $site =====" >> "$R/core-final.txt"
    php "$WPCLI" \
      --path="$site" \
      --skip-plugins \
      --skip-themes \
      core verify-checksums \
      >> "$R/core-final.txt" 2>&1

echo "===== $site =====" >> "$R/root-extras.txt"
    php "$WPCLI" \
      --path="$site" \
      --skip-plugins \
      --skip-themes \
      core verify-checksums \
      --include-root \
      >> "$R/root-extras.txt" 2>&1

echo "===== $site =====" >> "$R/plugins-final.txt"
    php "$WPCLI" \
      --path="$site" \
      --skip-plugins \
      --skip-themes \
      plugin verify-checksums \
      --all \
      --strict \
      >> "$R/plugins-final.txt" 2>&1

echo "===== $site =====" >> "$R/themes-list.txt"
    php "$WPCLI" \
      --path="$site" \
      --skip-plugins \
      --skip-themes \
      theme list \
      --fields=name,status,version,update \
      --format=table \
      >> "$R/themes-list.txt" 2>&1

if [ -d "$site/wp-content/uploads" ]; then
        find "$site/wp-content/uploads" \
          -type f \
          $ -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php5' -o -iname '*.php7' $ \
          -print 2>/dev/null \
          >> "$R/php-in-uploads.txt"
    fi

grep -RIl \
      --include='*.jpg' \
      --include='*.jpeg' \
      --include='*.png' \
      --include='*.gif' \
      --include='*.ico' \
      --include='*.txt' \
      '<?php' \
      "$site/wp-content" \
      2>/dev/null \
      >> "$R/disguised-php.txt"

done < "$LIST"

echo "FULL WORDPRESS AUDIT FINISHED"
EOF

#1789512375
chmod +x /home/verseaumee/security-scan/full-wp-audit.sh
#1789512380
nohup /home/verseaumee/security-scan/full-wp-audit.sh > /home/verseaumee/security-scan/reports/full-wp-audit.log 2>&1 &
#1789512394
tail -30 /home/verseaumee/security-scan/reports/full-wp-audit.log
#1789512404
echo "CORE PROBLEMS:"
#1789512404
grep -Ec "doesn't verify|doesn't exist|Error:" /home/verseaumee/security-scan/reports/core-final.txt
#1789512404
echo "ROOT EXTRAS:"
#1789512404
grep -c "File should not exist:" /home/verseaumee/security-scan/reports/root-extras.txt
#1789512404
echo "PLUGIN WARNINGS:"
#1789512404
grep -Ec "Warning:|Error:" /home/verseaumee/security-scan/reports/plugins-final.txt
#1789512404
echo "PHP IN UPLOADS:"
#1789512404
wc -l < /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789512404
echo "HIGH-CONFIDENCE PLUGIN/THEME HITS:"
#1789512404
wc -l < /home/verseaumee/security-scan/reports/content-high-confidence.txt
#1789512404
echo "PHP HIDDEN IN NON-PHP FILES:"
#1789512405
wc -l < /home/verseaumee/security-scan/reports/disguised-php.txt
#1789512437
echo "CORE PROBLEMS:"
#1789512437
grep -Ec "doesn't verify|doesn't exist|Error:" /home/verseaumee/security-scan/reports/core-final.txt
#1789512437
echo "ROOT EXTRAS:"
#1789512437
grep -c "File should not exist:" /home/verseaumee/security-scan/reports/root-extras.txt
#1789512437
echo "PLUGIN WARNINGS:"
#1789512437
grep -Ec "Warning:|Error:" /home/verseaumee/security-scan/reports/plugins-final.txt
#1789512437
echo "PHP IN UPLOADS:"
#1789512437
wc -l < /home/verseaumee/security-scan/reports/php-in-uploads.txt
#1789512437
echo "HIGH-CONFIDENCE PLUGIN/THEME HITS:"
#1789512437
wc -l < /home/verseaumee/security-scan/reports/content-high-confidence.txt

${this.title}

Code Editor : .bash_history