🚀 Advanced Web Server Manager
Complete File Manager & Terminal - Standalone Version
By Sid Gifari | Gifari Industries
Current path:
/
/
home2
/
birthday
✏️
Editing: .bash_history
#1747836175 ls #1747836218 cd ~ #1747836220 ls #1776056695 cd krishivgroups.in/ #1776056713 cat wp-includes/version.php | grep wp_version #1776056722 rm -rf wp-admin wp-includes #1776056730 wp core download --force --skip-content --version=6.9.1 #1776058211 find . -type d -exec chmod 755 {} \; #1776058225 find . -type f -exec chmod 644 {} \; #1776058263 rm -rf wp-admin wp-includes #1776058266 wp core download --force --skip-content --version=6.9.1 #1776087451 cd /home2/birthday/public_html/wp-content/themes/seomy/functions.php #1776087460 cd /home/birthday/public_html/wp-content/themes/seomy/functions.php #1776087473 cd home/birthday/public_html/wp-content/themes/seomy/functions.php #1776087481 cd home2/birthday/public_html/wp-content/themes/seomy/functions.php #1776087496 cd /home2/birthday #1776087505 cd public_html/ #1776087511 cd wp-content #1776087515 cd themes/ #1776087519 cd seomy/ #1776087544 php -l functions.php #1776147580 cd public_html/ #1776147672 cat wp-includes/version.php | grep wp_version #1776147678 rm -rf wp-admin wp-includes #1776147693 wp core download --force --skip-content --version=6.9.4 #1778154019 cd public_html/ #1778154099 cat wp-includes/version.php | grep wp_version #1778154106 rm -rf wp-admin wp-includes #1778154118 wp core download --force --skip-content --version=6.9.4 #1778154251 mysql -u birthday_wp222 -p birthday_wp222 #1778169278 cd public_html #1778169287 ll #1778169317 cd blog/ #1778169325 ll #1781264964 ls #1781264967 pwd #1781264974 cd public_html/ #1781264975 ls #1781264977 ll #1781265049 #!/bin/bash #1781265049 WEBROOT="/home2/birthday/public_html" #1781265049 cd "$WEBROOT" #1781265049 echo "====== STEP 1: Check .htaccess files for redirects ======" #1781265049 find . -name ".htaccess" -exec echo "--- {} ---" \; -exec cat {} \; #1781265049 echo "" #1781265049 echo "====== STEP 2: Scan PHP files for common malware patterns ======" #1781265049 echo "--- base64_decode injections ---" #1781265049 grep -rl "base64_decode" . --include="*.php" | grep -v "/wp-includes/" | head -30 #1781265050 echo "--- eval(base64 ---" #1781265050 grep -rl "eval(base64_decode" . --include="*.php" | head -20 #1781265050 echo "--- gzinflate / str_rot13 ---" #1781265050 grep -rl "gzinflate\|str_rot13\|gzuncompress" . --include="*.php" | head -20 #1781265050 echo "--- Suspicious redirect functions ---" #1781265050 grep -rl "header.*Location" . --include="*.php" | grep -v "/wp-includes/" | grep -v "/wp-admin/" | head -20 #1781265050 echo "--- Recently modified PHP files (last 30 days) ---" #1781265050 find . -name "*.php" -mtime -30 -not -path "*/wp-includes/*" | head -40 #1781265050 echo "" #1781265050 echo "====== STEP 3: Check wp-config.php for tampering ======" #1781265050 head -5 wp-config.php #1781265050 echo "" #1781265050 echo "====== STEP 4: Check active plugins ======" #1781265050 ls wp-content/plugins/ #1781265050 echo "" #1781265050 echo "====== STEP 5: Check themes ======" #1781265065 ls wp-content/themes/ #1781265685 curl -s https://raw.githubusercontent.com/Nsharma-04/wp-core-replace/main/wp-core-replace.sh | bash #1781267358 wp db query "SELECT ID, post_title, post_name, post_status FROM wp_posts WHERE post_name='services';" --path=/home2/birthday/public_html #1781267460 wp post get YOUR_POST_ID --field=post_content --path=/home2/birthday/public_html | head -50 #1781267477 # Find any post/page still containing malware keywords #1781267478 wp db query "SELECT ID, post_title, post_type FROM wp_posts WHERE post_content LIKE '%HOKBENTOTO%' OR post_content LIKE '%kiwkiwamtrsu%' OR post_content LIKE '%slot%' OR post_content LIKE '%toto%';" --path=/home2/birthday/public_html #1781267513 wp db query "SELECT ID, post_title, post_name, post_status FROM wpkq_posts WHERE post_name='services';" --path=/home2/birthday/public_html #1781267604 wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -50 #1781267621 wp post get 8063 --field=post_content --path=/home2/birthday/public_html | head -50 #1781267728 wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -100 #1781267734 wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -200 #1781267819 wp post delete 4056 --force --path=/home2/birthday/public_html #1781267838 wp db query "SELECT ID, post_title, post_name, post_status FROM wpkq_posts WHERE post_name='services';" --path=/home2/birthday/public_html #1781267846 wp rewrite flush --path=/home2/birthday/public_html #1781267848 echo "✅ Permalinks flushed" #1781267861 wp db query "SELECT ID, post_title, post_name, post_status, post_type FROM wpkq_posts WHERE post_content LIKE '%HOKBENTOTO%' OR post_content LIKE '%kiwkiwamtrsu%' OR post_content LIKE '%slot%gacor%' OR post_name LIKE '%toto%';" --path=/home2/birthday/public_html #1781267889 wp db query "SELECT ID, post_title, post_name, post_date, post_modified FROM wpkq_posts WHERE post_status='publish' ORDER BY post_modified DESC LIMIT 20;" --path=/home2/birthday/public_html #1781267988 # Check each of these for injected content #1781267988 for ID in 8962 43 8296 8297 10094; do echo "=== POST ID: $ID ==="; wp post get $ID --field=post_content --path=/home2/birthday/public_html | head -20; echo ""; done #1781268026 echo "=== FOOTER 480 (modified today) ===" #1781268026 wp post get 480 --field=post_content --path=/home2/birthday/public_html #1781268027 echo "" #1781268027 echo "=== HEADER 168 (modified today) ===" #1781268027 wp post get 168 --field=post_content --path=/home2/birthday/public_html #1781268602 find /home2/birthday/public_html -name "*.js" -mtime -1 | grep -v "node_modules\|cache" | head -20 #1781268620 wp db query "SELECT post_id, meta_key, LEFT(meta_value,200) FROM wpkq_postmeta WHERE meta_value LIKE '%kiwkiwamtrsu%' OR meta_value LIKE '%HOKBENTOTO%' OR meta_value LIKE '%eval(%';" --path=/home2/birthday/public_html #1781268634 find /home2/birthday/public_html/wp-content/themes/ -name "*.php" -mtime -1 | xargs grep -l "kiwkiwamtrsu\|HOKBENTOTO\|base64_decode\|eval(" 2>/dev/null #1781269266 wp post delete 4056 --force --path=/home2/birthday/public_html #1781269267 wp rewrite flush --path=/home2/birthday/public_html #1781269268 echo "✅ Done" #1781269284 wp db query "SELECT post_id, meta_key, LEFT(meta_value, 500) FROM wpkq_postmeta WHERE post_id=4056 AND meta_key LIKE '%elementor%';" --path=/home2/birthday/public_html #1781269293 wp db query "SELECT meta_key, LEFT(meta_value, 300) FROM wpkq_postmeta WHERE post_id=8063 AND meta_value LIKE '%slot%';" --path=/home2/birthday/public_html #1781269305 # WP Super Cache #1781269305 wp cache flush --path=/home2/birthday/public_html #1781269307 # Clear Elementor cache if active #1781269307 wp elementor flush-css --path=/home2/birthday/public_html 2>/dev/null #1781269309 # Clear any server-side cache folder #1781269309 rm -rf /home2/birthday/public_html/wp-content/cache/* 2>/dev/null #1781269309 echo "✅ Cache cleared" #1781269374 curl -I https://krishivgroups.com/services/ #1781269401 curl -I https://krishivgroups.com/ #1782545175 du -sch * | sort -h #1782545238 cd wapi.krishivgroups.com/ #1782545241 du -sch * | sort -h #1782545245 cd public/ #1782545248 du -sch * | sort -h #1782545253 cd uploads/ #1782545260 du -sch * | sort -h #1782545281 cd media/ #1782545285 du -sch * | sort -h #1782545300 du -sch * | grep G #1782545306 cd .. #1782545317 du -sch * | grep HG #1782545321 du -sch * | grep G #1782545325 cd uploads/ #1782545328 du -sch * | grep G #1782545349 cd .. #1782545350 ll #1782545372 ls #1782545381 cd #1782545428 cd wapi.krishivgroups.com/ #1782545452 du -sch .[!.]* * | sort -h #1782545459 cd public/ #1782545462 du -sch .[!.]* * | sort -h #1782545469 cd uploads/ #1782545473 du -sch .[!.]* * | sort -h #1782545491 pwd #1782545659 cd #1782545705 df -hT #1782545715 du -sch * #1782545729 cd wapi.krishivgroups.com/ #1782545732 du -sch * #1782545761 cd public/ #1782545763 du -sch * #1782545772 cd uploads/ #1782545775 du -sch * #1782545802 du -sch * | grep G #1782545831 du -sch .[!.]* * | sort -h #1782545853 pwd #1782559637 cd ~ #1782559760 tar -czf wapi.krishivgroups.com.tar.gz wapi.krishivgroups.com #1782709044 du -sch * #1782709118 cd wapi.krishivgroups.com #1782709121 du -sch * #1782709155 rm -rf ziqUCfKA #1782709165 rm -rf ziHgjTOT #1782709171 du -sch * #1782709189 cd public/ #1782709192 du -sch * #1782709196 cd uploads/ #1782709202 du -sch ( #1782709206 du -sch * #1782709219 du -sch * | grep G #1782975359 cd wapi.krishivgroups.com #1782975361 php artisan migrate #1782975374 php artisan config:clear #1782976257 cd wapi.krishivgroups.com #1782976730 php artisan migrate #1782977121 php artisan route:clear #1782977121 php artisan config:clear #1782977121 php artisan cache:clear #1783056839 cd wapi.krishivgroups.com #1783056845 crontab -l #1783056879 php artisan cache:clear #1783056884 php artisan queue:work --stop-when-empty -v #1783057013 php artisan cache:clear
💾 Save Changes
❌ Cancel