Done ! 403WebShell
403Webshell
Server IP : 87.98.154.146  /  Your IP : 216.73.216.74
Web Server : Apache
System : Linux webm011.cluster126.gra.hosting.ovh.net 6.18.39-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Tue Jul 21 12:03:15 CEST 2026 x86_64
User : alfamiffjq ( 77889)
PHP Version : 8.2.31
Disable Function : _dyuweyrj4,_dyuweyrj4r,dl
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /home/alfamiffjq/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /home/alfamiffjq//.mysql_history
SELECT u.ID, u.user_login, u.user_email
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities'
AND m.meta_value LIKE '%administrator%';
SELECT u.ID, u.user_login, u.user_email FROM wp_users u JOIN wp_usermeta m ON u.ID = m.user_id WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%administrator%';
DELETE FROM wp_usermeta WHERE user_id IN (6,7,8,9,10,11,12);
DELETE FROM wp_users WHERE ID IN (6,7,8,9,10,11,12);
SELECT ID, user_login, user_email
FROM wp_users
WHERE user_login = 'mainauth';
SELECT ID, user_login, user_email FROM wp_users WHERE user_login = 'mainauth';
SELECT ID, user_login, user_email FROM wp_users;
DELETE FROM wp_usermeta WHERE user_id IN (13);
DELETE FROM wp_users WHERE ID IN (13);
SELECT ID, user_login, user_email FROM wp_users;
DELETE FROM wp_usermeta WHERE user_id = 14;
DELETE FROM wp_users WHERE ID = 14;
SELECT option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_name IN ('cron','_transient_doing_cron');
SELECT option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_name IN ('cron','_transient_doing_cron');
SELECT option_name
FROM wp_options
WHERE option_value LIKE '%admlnlx%'
   OR option_value LIKE '%mainauth%'
   OR option_value LIKE '%wp_insert_user%'
   OR option_value LIKE '%create_user%'
LIMIT 50;
SELECT option_name FROM wp_options WHERE option_value LIKE '%admlnlx%'    OR option_value LIKE '%mainauth%'    OR option_value LIKE '%wp_insert_user%'    OR option_value LIKE '%create_user%' LIMIT 50;
SELECT ID FROM wp_users WHERE user_login='admlnlx';
DELETE FROM wp_usermeta WHERE user_id IN (SELECT ID FROM wp_users WHERE user_login='admlnlx');
DELETE FROM wp_users WHERE user_login='admlnlx';
SELECT ID, user_login, user_email FROM wp_users;
DELETE FROM wp_options WHERE option_name IN ('_pre_user_id','theme_dc_aluma_tools','theme_aluma_times');
SELECT ID, user_login, user_email FROM wp_users;
show datatbases;
SELECT ID, user_login, user_email FROM wp_users;
exit;
UPDATE wp_options SET option_value='twentytwentyfour' WHERE option_name IN ('template','stylesheet');
UPDATE wp_options SET option_value='' WHERE option_name='current_theme';
SELECT ID, user_login, user_email FROM wp_users;
SELECT * FROM wp_usermeta 
WHERE meta_key = 'wp_capabilities';
SELECT * FROM wp_usermeta  WHERE meta_key = 'wp_capabilities';
SELECT option_name FROM wp_options 
WHERE option_value REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT option_name FROM wp_options  WHERE option_value REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT post_title FROM wp_posts 
WHERE post_content REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT post_title FROM wp_posts  WHERE post_content REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT meta_key FROM wp_postmeta 
WHERE meta_value REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT meta_key FROM wp_postmeta  WHERE meta_value REGEXP 'eval\\(|base64|gzinflate|openssl_decrypt';
SELECT option_name FROM wp_options
WHERE option_name IN (
  'active_plugins',
  'siteurl',
  'home',
  'widget_text',
  'widget_custom_html'
);
SELECT option_name FROM wp_options WHERE option_name IN (   'active_plugins',   'siteurl',   'home',   'widget_text',   'widget_custom_html' );
SELECT option_value FROM wp_options 
WHERE option_name = 'widget_text';
SELECT option_value FROM wp_options  WHERE option_name = 'widget_text';
SELECT ID, post_title, post_status 
FROM wp_posts 
WHERE post_status NOT IN ('publish','draft','trash');
SELECT ID, post_title, post_status  FROM wp_posts  WHERE post_status NOT IN ('publish','draft','trash');
SELECT ID, post_title 
FROM wp_posts 
WHERE post_content LIKE '%display:none%';
SELECT ID, post_title  FROM wp_posts  WHERE post_content LIKE '%display:none%';
SELECT option_value FROM wp_options 
WHERE option_name = 'cron';
SELECT option_value FROM wp_options  WHERE option_name = 'cron';
SELECT option_value FROM wp_options 
WHERE option_name = 'active_plugins';
SELECT option_value FROM wp_options  WHERE option_name = 'active_plugins';
SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
ORDER BY u.user_registered DESC
LIMIT 30;
SELECT u.ID, u.user_login, u.user_email, u.user_registered FROM wp_users u ORDER BY u.user_registered DESC LIMIT 30;
SELECT u.ID, u.user_login, u.user_email
FROM wp_users u
JOIN wp_usermeta m ON m.user_id=u.ID
WHERE m.meta_key='wp_capabilities'
  AND m.meta_value LIKE '%administrator%';
SELECT u.ID, u.user_login, u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities'   AND m.meta_value LIKE '%administrator%';
SELECT ID, post_title
FROM wp_posts
WHERE post_content REGEXP '(base64_decode|gzinflate|eval\\(|shell_exec|system\\(|passthru|assert\\(|preg_replace\\s*\\(.*\\/e|fromCharCode|String\\.fromCharCode|document\\.write\\(|atob\\(|unescape\\()'
LIMIT 200;
SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '(base64_decode|gzinflate|eval\\(|shell_exec|system\\(|passthru|assert\\(|preg_replace\\s*\\(.*\\/e|fromCharCode|String\\.fromCharCode|document\\.write\\(|atob\\(|unescape\\()' LIMIT 200;
SELECT ID, post_title
FROM wp_posts
WHERE post_excerpt REGEXP '(base64_decode|gzinflate|eval\\(|fromCharCode|atob\\()'
LIMIT 200;
SELECT ID, post_title FROM wp_posts WHERE post_excerpt REGEXP '(base64_decode|gzinflate|eval\\(|fromCharCode|atob\\()' LIMIT 200;
SELECT ID, post_title, post_type, post_status, post_date, LEFT(post_content, 500) AS preview
FROM wp_posts
WHERE ID=21309;
SELECT ID, post_title, post_type, post_status, post_date, LEFT(post_content, 500) AS preview FROM wp_posts WHERE ID=21309;
SELECT post_content
FROM wp_posts
WHERE ID=21309;
SELECT post_content FROM wp_posts WHERE ID=21309;
SHOW TABLES LIKE '%wpcode%';
SELECT id, title, status
FROM wp_wpcode_snippets
WHERE id=21309 OR title LIKE '%Désactiver%commentaires%';
SELECT id, title, status FROM wp_wpcode_snippets WHERE id=21309 OR title LIKE '%Désactiver%commentaires%';
UPDATE wp_wpcode_snippets
SET status='inactive'
WHERE id=21309;
UPDATE wp_wpcode_snippets SET status='inactive' WHERE id=21309;
DESCRIBE wp_wpcode_snippets;
SELECT option_id, option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_name IN ('wp_custom_filters','wp_custom_range')
   OR option_name = MD5(SHA1(@@hostname))
LIMIT 50;
SELECT option_id, option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_name IN ('wp_custom_filters','wp_custom_range')    OR option_name = MD5(SHA1(@@hostname)) LIMIT 50;
SELECT option_id, option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_name REGEXP '^[a-f0-9]{32}$'
ORDER BY len DESC
LIMIT 50;
SELECT option_id, option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_name REGEXP '^[a-f0-9]{32}$' ORDER BY len DESC LIMIT 50;
SELECT option_id, option_name, LEFT(option_value, 80) AS preview, LENGTH(option_value) AS len
FROM wp_options
WHERE option_value REGEXP '(base64|YTox|YToy|YToz|czo|O:|a:)'
ORDER BY len DESC
LIMIT 200;
SELECT option_id, option_name, LEFT(option_value, 80) AS preview, LENGTH(option_value) AS len FROM wp_options WHERE option_value REGEXP '(base64|YTox|YToy|YToz|czo|O:|a:)' ORDER BY len DESC LIMIT 200;
SELECT ID, post_title, post_status, post_date
FROM wp_posts
WHERE post_type='wpcode'
ORDER BY post_date DESC
LIMIT 50;
SELECT ID, post_title, post_status, post_date FROM wp_posts WHERE post_type='wpcode' ORDER BY post_date DESC LIMIT 50;
UPDATE wp_posts
SET post_status='draft'
WHERE post_type='wpcode';
UPDATE wp_posts SET post_status='draft' WHERE post_type='wpcode';
SELECT option_id, option_name, option_value
FROM wp_options
WHERE option_name IN ('wp_custom_range','9590a869989e3004440c15c64ad4fada','b4e4f8c51f24839e97a762623ef28485');
SELECT option_id, option_name, option_value FROM wp_options WHERE option_name IN ('wp_custom_range','9590a869989e3004440c15c64ad4fada','b4e4f8c51f24839e97a762623ef28485');
DELETE FROM wp_options
WHERE option_name='wp_custom_range'
   OR option_name IN ('9590a869989e3004440c15c64ad4fada','b4e4f8c51f24839e97a762623ef28485');
DELETE FROM wp_options WHERE option_name='wp_custom_range'    OR option_name IN ('9590a869989e3004440c15c64ad4fada','b4e4f8c51f24839e97a762623ef28485');
SELECT option_id, option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_name REGEXP '^[a-f0-9]{32}$'
LIMIT 200;
SELECT option_id, option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_name REGEXP '^[a-f0-9]{32}$' LIMIT 200;
SELECT option_id, option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_value LIKE '%base64_decode%'
   OR option_value LIKE '%gzinflate%'
   OR option_value LIKE '%unserialize(base64_decode%'
   OR option_value LIKE '%wp_custom_range%'
   OR option_value LIKE '%wp_custom_filters%'
   OR option_value LIKE '%home_links_custom_%'
LIMIT 200;
SELECT option_id, option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_value LIKE '%base64_decode%'    OR option_value LIKE '%gzinflate%'    OR option_value LIKE '%unserialize(base64_decode%'    OR option_value LIKE '%wp_custom_range%'    OR option_value LIKE '%wp_custom_filters%'    OR option_value LIKE '%home_links_custom_%' LIMIT 200;
SELECT ID, post_title, post_type, post_status
FROM wp_posts
WHERE post_content LIKE '%base64_decode%'
   OR post_content LIKE '%gzinflate%'
   OR post_content LIKE '%wp_custom_range%'
   OR post_content LIKE '%home_links_custom_%'
LIMIT 200;
SELECT ID, post_title, post_type, post_status FROM wp_posts WHERE post_content LIKE '%base64_decode%'    OR post_content LIKE '%gzinflate%'    OR post_content LIKE '%wp_custom_range%'    OR post_content LIKE '%home_links_custom_%' LIMIT 200;
SELECT option_id, option_name, LENGTH(option_value) AS len, LEFT(option_value, 300) AS preview
FROM wp_options
WHERE option_name='wpcode_snippets';
SELECT option_id, option_name, LENGTH(option_value) AS len, LEFT(option_value, 300) AS preview FROM wp_options WHERE option_name='wpcode_snippets';
SELECT option_id, LOCATE('21309', option_value) AS pos_id,
              LOCATE('c03083c974764a1b58b3f44cb0a931b5', option_value) AS pos_hash
FROM wp_options
WHERE option_name='wpcode_snippets';
SELECT option_id, LOCATE('21309', option_value) AS pos_id,               LOCATE('c03083c974764a1b58b3f44cb0a931b5', option_value) AS pos_hash FROM wp_options WHERE option_name='wpcode_snippets';
UPDATE wp_options
SET option_name = CONCAT('QUARANTINE_wpcode_snippets_', UNIX_TIMESTAMP())
WHERE option_name='wpcode_snippets';
UPDATE wp_options SET option_name = CONCAT('QUARANTINE_wpcode_snippets_', UNIX_TIMESTAMP()) WHERE option_name='wpcode_snippets';
SELECT option_id, option_name, LENGTH(option_value) AS len
FROM wp_options
WHERE option_name LIKE 'wpcode_snippets%'
   OR option_name LIKE 'QUARANTINE_wpcode_snippets_%';
SELECT option_id, option_name, LENGTH(option_value) AS len FROM wp_options WHERE option_name LIKE 'wpcode_snippets%'    OR option_name LIKE 'QUARANTINE_wpcode_snippets_%';
DELETE FROM wp_posts WHERE ID=21309;
DELETE FROM wp_postmeta WHERE post_id=21309;
SELECT ID, post_title, post_type, post_status
FROM wp_posts
WHERE post_type='wpcode'
ORDER BY ID DESC
LIMIT 20;
SELECT ID, post_title, post_type, post_status FROM wp_posts WHERE post_type='wpcode' ORDER BY ID DESC LIMIT 20;
cd ~/www/alfamifwp/wp-content/plugins
# check
ls -la | egrep -i 'wpcode|insert|snippet|ssh-sftp|updater|support' || true
# désactive le plugin chelou
[ -d ssh-sftp-updater-support ] && mv -v ssh-sftp-updater-support ssh-sftp-updater-support.DISABLED_$(date +%F_%H%M)
# si tu vois un plugin wpcode, tu peux aussi le désactiver temporairement
ls -la | egrep -i '^d.*wpcode|insert|snippet' || true
SELECT option_name
FROM wp_options
WHERE option_value LIKE '%c03083c974764a1b58b3f44cb0a931b5%'
   OR option_value LIKE '%home_links_custom_%'
   OR option_value LIKE '%wp_custom_filters%'
LIMIT 50;
SELECT option_name FROM wp_options WHERE option_value LIKE '%c03083c974764a1b58b3f44cb0a931b5%'    OR option_value LIKE '%home_links_custom_%'    OR option_value LIKE '%wp_custom_filters%' LIMIT 50;
DELETE FROM wp_options
WHERE option_name LIKE 'QUARANTINE_wpcode_snippets_%';
DELETE FROM wp_options WHERE option_name LIKE 'QUARANTINE_wpcode_snippets_%';
SELECT option_id, option_name
FROM wp_options
WHERE option_name LIKE 'QUARANTINE_wpcode_snippets_%'
   OR option_name='wpcode_snippets';
SELECT option_id, option_name FROM wp_options WHERE option_name LIKE 'QUARANTINE_wpcode_snippets_%'    OR option_name='wpcode_snippets';
-- voir les IDs exacts
SELECT ID, user_login, user_email 
FROM wp_users
WHERE user_login='adminwp' OR user_email LIKE '%nomxwp.info%';
SELECT ID, user_login, user_email  FROM wp_users WHERE user_login='adminwp' OR user_email LIKE '%nomxwp.info%';
DELETE FROM wp_users 
WHERE user_login='adminwp' OR user_email LIKE '%nomxwp.info%';
DELETE FROM wp_users  WHERE user_login='adminwp' OR user_email LIKE '%nomxwp.info%';
DELETE FROM wp_usermeta
WHERE user_id NOT IN (SELECT ID FROM wp_users);
DELETE FROM wp_usermeta WHERE user_id NOT IN (SELECT ID FROM wp_users);
SELECT option_value 
FROM wp_options 
WHERE option_name='cron';
SELECT option_value  FROM wp_options  WHERE option_name='cron';
SELECT option_name, option_value
FROM wp_options
WHERE option_name LIKE '%cron%';
SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%cron%';
cd ~/www/alfamifwp/wp-content
ls -la mu-plugins || echo "Pas de mu-plugins"
-- 1) Options
SELECT option_id, option_name, LEFT(option_value, 200) AS preview
FROM wp_options
WHERE option_value LIKE '%nomxwp%'
   OR option_value LIKE '%adminwp%'
LIMIT 200;
SELECT option_id, option_name, LEFT(option_value, 200) AS preview FROM wp_options WHERE option_value LIKE '%nomxwp%'    OR option_value LIKE '%adminwp%' LIMIT 200;
-- 2) Usermeta (souvent là qu’ils stockent des payloads)
SELECT user_id, meta_key, LEFT(meta_value, 200) AS preview
FROM wp_usermeta
WHERE meta_value LIKE '%nomxwp%'
   OR meta_value LIKE '%adminwp%'
LIMIT 200;
SELECT user_id, meta_key, LEFT(meta_value, 200) AS preview FROM wp_usermeta WHERE meta_value LIKE '%nomxwp%'    OR meta_value LIKE '%adminwp%' LIMIT 200;
-- 3) Postmeta
SELECT post_id, meta_key, LEFT(meta_value, 200) AS preview
FROM wp_postmeta
WHERE meta_value LIKE '%nomxwp%'
   OR meta_value LIKE '%adminwp%'
LIMIT 200;
SELECT post_id, meta_key, LEFT(meta_value, 200) AS preview FROM wp_postmeta WHERE meta_value LIKE '%nomxwp%'    OR meta_value LIKE '%adminwp%' LIMIT 200;
-- 4) Posts content (au cas où)
SELECT ID, post_type, post_status, post_title
FROM wp_posts
WHERE post_content LIKE '%nomxwp%'
   OR post_content LIKE '%adminwp%'
LIMIT 200;
SELECT ID, post_type, post_status, post_title FROM wp_posts WHERE post_content LIKE '%nomxwp%'    OR post_content LIKE '%adminwp%' LIMIT 200;
SELECT ID, user_login, user_email, user_registered
FROM wp_users
ORDER BY ID ASC;
SELECT ID, user_login, user_email, user_registered FROM wp_users ORDER BY ID ASC;
SELECT 
  u.ID,
  u.user_login,
  u.user_email,
  um.meta_value
FROM wp_users u
JOIN wp_usermeta um ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities'
AND um.meta_value LIKE '%administrator%';
SELECT    u.ID,   u.user_login,   u.user_email,   um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities' AND um.meta_value LIKE '%administrator%';
DELETE FROM wp_usermeta
WHERE user_id IN (6,7,8,9,10,11,12,13,14,21,22,23,24,25,26,27,28,29);
DELETE FROM wp_usermeta WHERE user_id IN (6,7,8,9,10,11,12,13,14,21,22,23,24,25,26,27,28,29);
DELETE FROM wp_users
WHERE ID IN (6,7,8,9,10,11,12,13,14,21,22,23,24,25,26,27,28,29);
DELETE FROM wp_users WHERE ID IN (6,7,8,9,10,11,12,13,14,21,22,23,24,25,26,27,28,29);
SELECT ID, user_login, user_email, user_registered
FROM wp_users
ORDER BY ID ASC;
SELECT ID, user_login, user_email, user_registered FROM wp_users ORDER BY ID ASC;
SELECT 
  u.ID,
  u.user_login,
  u.user_email,
  um.meta_value
FROM wp_users u
JOIN wp_usermeta um ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities';
SELECT    u.ID,   u.user_login,   u.user_email,   um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities';
SELECT u.ID, u.user_login, u.user_email, um.meta_value
FROM wp_users u
LEFT JOIN wp_usermeta um
ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities';
SELECT u.ID, u.user_login, u.user_email, um.meta_value FROM wp_users u LEFT JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities';
SELECT ID, user_login, user_email, user_registered
FROM wp_users;
SELECT ID, user_login, user_email, user_registered FROM wp_users;
SELECT user_id, meta_key, meta_value
FROM wp_usermeta
WHERE meta_key LIKE '%capabilities%';
SELECT user_id, meta_key, meta_value FROM wp_usermeta WHERE meta_key LIKE '%capabilities%';
SELECT ID,user_login,user_email
FROM wp_users
ORDER BY ID;
SELECT ID,user_login,user_email FROM wp_users ORDER BY ID;
DELETE FROM wp_users
WHERE ID IN (6,7,8,30,31,32);
DELETE FROM wp_users WHERE ID IN (6,7,8,30,31,32);
DELETE FROM wp_usermeta
WHERE user_id IN (6,7,8,30,31,32);
DELETE FROM wp_usermeta WHERE user_id IN (6,7,8,30,31,32);
ls -lah wp-content/plugins
exit
SELECT option_name
FROM wp_options
WHERE option_name LIKE '%cron%';
SELECT option_name FROM wp_options WHERE option_name LIKE '%cron%';

Youez - 2016 - github.com/yon3zu
LinuXploit