MARK=1314123 USER=sathwell uid=1598 UNAME=Linux canopus.awedns.com 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 SAPI=litespeed DF=exec,shell_exec,passthru,system,proc_open,popen,parse_ini_file,show_source,socket_create_listen,socket_create,syslog OB= SAFE= F pcntl_exec=N F proc_open=N F popen=N F exec=N F shell_exec=N F system=N F passthru=N F FFI=N F imap_open=Y F mail=Y F putenv=Y F dl=N F curl_exec=Y F fsockopen=Y F stream_socket_client=Y F symlink=Y F link=Y F posix_setuid=Y F posix_geteuid=Y ==== /etc/os-release ==== ==== /proc/version ==== Linux version 5.14.0-611.49.1.el9_7.x86_64 (mockbuild@x64-builder03.almalinux.org) (gcc (GCC) 11.5.0 20240719 (Red Hat 11.5.0-11), GNU ld version 2.35.2-67.el9_7.1) #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 ==== /proc/self/status Cap ==== Tgid: 3003916 Ngid: 0 Uid: 1598 1598 1598 1598 Gid: 1602 1602 1602 1602 NStgid: 3003916 NSpgid: 3003916 CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000000000000000 CapAmb: 0000000000000000 ==== home listing (no dotfilter) ==== . .. .HttpRequest .MirrorSearch .bash_logout .bash_profile .bashrc .cache .cagefs .caldav .cl.selector .clwpos .cpan .cpanel .cpcpan .cphorde .cpobjcache .env .forward .ftpquota .gnupg .htpasswds .imunify_patch_id .koality .lastlogin .myimunify_id .pearrc .pki .procmailrc .putty .razor .sitepad .softaculous .spamassassin .spamassassinboxenable .spamassassinenable .ssh .subaccounts .trash .wp-cli .wp-toolkit .wp-toolkit-identifier .zshrc access-logs bin error_log etc logs lscache lscmData mail mysql_backup perl perl5 php public_ftp public_html sathwell.com sathwell.com.my site_publisher softaculous_backups softaculous_templates ssl tmp wordpress-backups www ==== .lastlogin ==== 115.164.191.156 # 2026-05-13 17:46:27 +0800 115.164.180.253 # 2026-05-14 12:51:53 +0800 182.62.146.148 # 2026-05-14 15:55:17 +0800 115.164.33.168 # 2026-05-14 22:03:36 +0800 115.164.119.56 # 2026-05-15 17:50:30 +0800 182.62.44.65 # 2026-05-22 10:40:07 +0800 182.62.227.96 # 2026-06-15 18:34:20 +0800 182.62.174.138 # 2026-06-16 00:41:20 +0800 182.62.191.104 # 2026-06-16 14:27:22 +0800 115.164.82.145 # 2026-06-16 22:45:59 +0800 182.62.75.58 # 2026-06-19 12:39:33 +0800 182.62.161.130 # 2026-07-27 14:05:57 +0800 115.164.119.5 # 2026-10-05 15:14:44 +0800 115.164.36.54 # 2026-10-06 13:15:47 +0800 ==== .my.cnf ==== ==== .ssh ==== -- authorized_keys size=1 mode=0644 -- putty size=32 mode=0700 ==== .cpanel/nvdata (keys) ==== CP Cpanel_SSL_DCV_DNS_Mutex CP caches CP datastore CP ea-php-cli CP email_accounts.json CP email_accounts_count CP icals CP live-engine-connector-Mf_ez4QfiZ.sock CP live-engine-connector-d_wOf7mL_y.sock CP nvdata CP nvdata.cache CP sitejet CP vcards ==== etc (cpanel passwd?) ==== ETC ftpquota ETC prevail.com.my prevail.com.my/@pwcache prevail.com.my/_privs.json {"mailman":{}} prevail.com.my/passwd prevail.com.my/quota prevail.com.my/shadow prevail.com.my/uma.rcube.db prevail.com.my/uma.rcube.db.1774297744 prevail.com.my/uma.rcube.db.1775593706 prevail.com.my/uma.rcube.db.1781296118 prevail.com.my/uma.rcube.db.1784147279 prevail.com.my/uma.rcube.db.1787084914 prevail.com.my/uma.rcube.db.1789158646 prevail.com.my/uma.rcube.db.latest ETC sathwell.com.my sathwell.com.my/@pwcache sathwell.com.my/_privs.json {"mailman":{}} sathwell.com.my/cheeteo.rcube.db sathwell.com.my/cheeteo.rcube.db.1727948083 sathwell.com.my/cheeteo.rcube.db.1729196809 sathwell.com.my/cheeteo.rcube.db.1743539279 sathwell.com.my/cheeteo.rcube.db.1748636848 sathwell.com.my/cheeteo.rcube.db.1748982439 sathwell.com.my/cheeteo.rcube.db.1757449733 sathwell.com.my/cheeteo.rcube.db.latest sathwell.com.my/itsupport sathwell.com.my/itsupport.rcube.db sathwell.com.my/itsupport.rcube.db.1727948083 sathwell.com.my/itsupport.rcube.db.1729196809 sathwell.com.my/itsupport.rcube.db.1743539279 sathwell.com.my/itsupport.rcube.db.1748636848 sathwell.com.my/itsupport.rcube.db.1748982439 sathwell.com.my/itsupport.rcube.db.1757449733 sathwell.com.my/itsupport.rcube.db.latest sathwell.com.my/jenniferc.rcube.db sathwell.com.my/jenniferc.rcube.db.1727948083 sathwell.com.my/jenniferc.rcube.db.1729196809 sathwell.com.my/jenniferc.rcube.db.1743539279 sathwell.com.my/jenniferc.rcube.db.1748636848 sathwell.com.my/jenniferc.rcube.db.1748982439 sathwell.com.my/jenniferc.rcube.db.1757449733 sathwell.com.my/jenniferc.rcube.db.latest sathwell.com.my/passwd sathwell.com.my/puah.rcube.db sathwell.com.my/puah.rcube.db.1727948083 sathwell.com.my/puah.rcube.db.1729196809 sathwell.com.my/puah.rcube.db.1743539279 sathwell.com.my/puah.rcube.db.1748636848 sathwell.com.my/puah.rcube.db.1748982439 sathwell.com.my/puah.rcube.db.1757449734 sathwell.com.my/puah.rcube.db.latest sathwell.com.my/puganeswaran.rcube.db sathwell.com.my/puganeswaran.rcube.db.1727948083 sathwell.com.my/puganeswaran.rcube.db.1729196809 sathwell.com.my/puganeswaran.rcube.db.1743539279 sathwell.com.my/puganeswaran.rcube.db.1748636848 sathwell.com.my/puganeswaran.rcube.db.1748982439 sathwell.com.my/puganeswaran.rcube.db.1757449734 sathwell.com.my/puganeswaran.rcube.db.latest sathwell.com.my/quota sathwell.com.my/shadow sathwell.com.my/sripremraj.rcube.db sathwell.com.my/sripremraj.rcube.db.1727948083 sathwell.com.my/sripremraj.rcube.db.1729196809 sathwell.com.my/sripremraj.rcube.db.1743539279 sathwell.com.my/sripremraj.rcube.db.1748636848 sathwell.com.my/sripremraj.rcube.db.1748982439 sathwell.com.my/sripremraj.rcube.db.1757449734 sathwell.com.my/sripremraj.rcube.db.latest sathwell.com.my/support.rcube.db sathwell.com.my/support.rcube.db.1727948083 sathwell.com.my/support.rcube.db.1729196809 sathwell.com.my/support.rcube.db.1743539279 sathwell.com.my/support.rcube.db.1748636849 sathwell.com.my/support.rcube.db.1748982439 sathwell.com.my/support.rcube.db.1757449734 sathwell.com.my/support.rcube.db.latest ETC sathwell.rcube.db ETC sathwell.rcube.db.1774297744 ETC sathwell.rcube.db.1775593706 ETC sathwell.rcube.db.1781296118 ETC sathwell.rcube.db.1784147279 ETC sathwell.rcube.db.1787084913 ETC sathwell.rcube.db.1789158646 ETC sathwell.rcube.db.latest ETC superwell.pro superwell.pro/@pwcache superwell.pro/passwd superwell.pro/shadow superwell.pro/support.rcube.db superwell.pro/support.rcube.db.1774297744 superwell.pro/support.rcube.db.1775593706 superwell.pro/support.rcube.db.1781296118 superwell.pro/support.rcube.db.1784147279 superwell.pro/support.rcube.db.1787084914 superwell.pro/support.rcube.db.1789158646 superwell.pro/support.rcube.db.latest ETC superwelljuniors.com superwelljuniors.com/@pwcache superwelljuniors.com/_privs.json {"mailman":{}} superwelljuniors.com/anusha.rcube.db.1727948083 superwelljuniors.com/anusha.rcube.db.1729196809 superwelljuniors.com/anusha.rcube.db.1743539278 superwelljuniors.com/anusha.rcube.db.1748636848 superwelljuniors.com/anusha.rcube.db.1748982439 superwelljuniors.com/anusha.rcube.db.1757449733 superwelljuniors.com/anusha.rcube.db.latest superwelljuniors.com/christina.rcube.db superwelljuniors.com/christina.rcube.db.1774297744 superwelljuniors.com/christina.rcube.db.1775593706 superwelljuniors.com/christina.rcube.db.1781296118 superwelljuniors.com/christina.rcube.db.1784147279 superwelljuniors.com/christina.rcube.db.1787084913 superwelljuniors.com/christina.rcube.db.1789158646 superwelljuniors.com/christina.rcube.db.latest superwelljuniors.com/customer.rcube.db.1771360164 superwelljuniors.com/customer.rcube.db.1774297744 superwelljuniors.com/customer.rcube.db.latest superwelljuniors.com/customer1.rcube.db superwelljuniors.com/customer1.rcube.db.1781296118 superwelljuniors.com/customer1.rcube.db.1784147279 superwelljuniors.com/customer1.rcube.db.1787084913 superwelljuniors.com/customer1.rcube.db.1789158646 superwelljuniors.com/customer1.rcube.db.latest superwelljuniors.com/developer.rcube.db superwelljuniors.com/developer.rcube.db.1774297744 superwelljuniors.com/developer.rcube.db.1775593706 superwelljuniors.com/developer.rcube.db.1781296118 superwelljuniors.com/developer.rcube.db.1784147279 superwelljuniors.com/developer.rcube.db.1787084913 superwelljuniors.com/developer.rcube.db.1789158646 superwelljuniors.com/developer.rcube.db.latest superwelljuniors.com/info.rcube.db superwelljuniors.com/info.rcube.db.1774297744 superwelljuniors.com/info.rcube.db.1775593706 superwelljuniors.com/info.rcube.db.1781296118 superwelljuniors.com/info.rcube.db.1784147279 superwelljuniors.com/info.rcube.db.1787084913 superwelljuniors.com/info.rcube.db.1789158646 superwelljuniors.com/info.rcube.db.latest superwelljuniors.com/jenniferc.rcube.db superwelljuniors.com/jenniferc.rcube.db.1774297744 superwelljuniors.com/jenniferc.rcube.db.1775593706 superwelljuniors.com/jenniferc.rcube.db.1781296118 superwelljuniors.com/jenniferc.rcube.db.1784147279 superwelljuniors.com/jenniferc.rcube.db.1787084913 superwelljuniors.com/jenniferc.rcube.db.1789158646 superwelljuniors.com/jenniferc.rcube.db.latest superwelljuniors.com/jyomerp.rcube.db superwelljuniors.com/jyomerp.rcube.db.1774297744 superwelljuniors.com/jyomerp.rcube.db.1775593706 superwelljuniors.com/jyomerp.rcube.db.1781296118 superwelljuniors.com/jyomerp.rcube.db.1784147279 superwelljuniors.com/jyomerp.rcube.db.1787084913 superwelljuniors.com/jyomerp.rcube.db.1789158646 superwelljuniors.com/jyomerp.rcube.db.latest superwelljuniors.com/marcustan.rcube.db superwelljuniors.com/marcustan.rcube.db.1774297744 superwelljuniors.com/marcustan.rcube.db.1775593706 superwelljuniors.com/marcustan.rcube.db.1781296118 superwelljuniors.com/marcustan.rcube.db.1784147279 superwelljuniors.com/marcustan.rcube.db.1787084913 superwelljuniors.com/marcustan.rcube.db.1789158646 superwelljuniors.com/marcustan.rcube.db.latest superwelljuniors.com/passwd superwelljuniors.com/puah.rcube.db superwelljuniors.com/puah.rcube.db.1774297744 superwelljuniors.com/puah.rcube.db.1775593706 superwelljuniors.com/puah.rcube.db.1781296118 superwelljuniors.com/puah.rcube.db.1784147279 superwelljuniors.com/puah.rcube.db.1787084913 superwelljuniors.com/puah.rcube.db.1789158646 superwelljuniors.com/puah.rcube.db.latest superwelljuniors.com/puganeswaran.rcube.db superwelljuniors.com/puganeswaran.rcube.db.1774297744 superwelljuniors.com/puganeswaran.rcube.db.1775593706 superwelljuniors.com/puganeswaran.rcube.db.1781296118 superwelljuniors.com/puganeswaran.rcube.db.1784147279 superwelljuniors.com/puganeswaran.rcube.db.1787084913 superwelljuniors.com/puganeswaran.rcube.db.1789158646 superwelljuniors.com/puganeswaran.rcube.db.latest superwelljuniors.com/quota marcustan:1073741824 superpulse:1073741824 customer1:1073741824 superwelljuniors.com/schools.rcube.db superwelljuniors.com/schools.rcube.db.1774297744 superwelljuniors.com/schools.rcube.db.1775593706 superwelljuniors.com/schools.rcube.db.1781296118 superwelljuniors.com/schools.rcube.db.1784147279 superwelljuniors.com/schools.rcube.db.1787084913 superwelljuniors.com/schools.rcube.db.1789158646 superwelljuniors.com/schools.rcube.db.latest superwelljuniors.com/shadow superwelljuniors.com/sripremraj.rcube.db superwelljuniors.com/sripremraj.rcube.db.1774297744 superwelljuniors.com/sripremraj.rcube.db.1775593706 superwelljuniors.com/sripremraj.rcube.db.1781296118 superwelljuniors.com/sripremraj.rcube.db.1784147279 superwelljuniors.com/sripremraj.rcube.db.1787084913 superwelljuniors.com/sripremraj.rcube.db.1789158646 superwelljuniors.com/sripremraj.rcube.db.latest superwelljuniors.com/superpulse.rcube.db superwelljuniors.com/superpulse.rcube.db.1774297744 superwelljuniors.com/superpulse.rcube.db.1775593706 superwelljuniors.com/superpulse.rcube.db.1781296118 superwelljuniors.com/superpulse.rcube.db.1784147279 superwelljuniors.com/superpulse.rcube.db.1787084914 superwelljuniors.com/superpulse.rcube.db.1789158646 superwelljuniors.com/superpulse.rcube.db.latest superwelljuniors.com/support.rcube.db superwelljuniors.com/support.rcube.db.1774297744 superwelljuniors.com/support.rcube.db.1775593706 superwelljuniors.com/support.rcube.db.1781296118 superwelljuniors.com/support.rcube.db.1784147279 superwelljuniors.com/support.rcube.db.1787084914 superwelljuniors.com/support.rcube.db.1789158646 superwelljuniors.com/support.rcube.db.latest ETC webdav webdav/passwd webdav/shadow ==== mail top ==== MAIL dovecot-acl-list MAIL dovecot-quota MAIL dovecot-uidlist MAIL dovecot-uidvalidity MAIL dovecot-uidvalidity.651e3a5f MAIL dovecot-uidvalidity.651e3a70 MAIL dovecot.index.cache MAIL dovecot.index.log MAIL dovecot.list.index MAIL dovecot.list.index.log MAIL dovecot.list.index.log.2 MAIL dovecot.mailbox.log MAIL mailbox_format.cpanel MAIL maildirsize MAIL prevail.com.my MAIL sathwell.com.my MAIL subscriptions MAIL superwell.pro MAIL superwelljuniors.com MAIL tmp ==== crontab-ish ==== CRON /var/spool/cron/sathwell exists=1 r=1 * * * * * /bin/sh -c 'id > /home/sathwell/tmp/l254_cron.out; uname -a >> /home/sathwell/tmp/l254_cron.out' CRON /var/spool/cron/crontabs/sathwell exists=0 r=0 CRON /etc/crontab exists=0 r=0 CRON /home/sathwell/.crontab exists=0 r=0 ==== bin ==== ==== cgi-bin perms ==== /home/sathwell/sathwell.com/cgi-bin w=1 l255.cgi l255.py l255_pe.cgi /home/sathwell/public_html/cgi-bin w=1 l255.cgi l255.py l255_dom.cgi l255_pe.cgi /home/sathwell/sathwell.com.my/cgi-bin w=0 ==== SUID sample (readable dirs only) ==== ==== writable interesting ==== /etc/cron.d w=0 e=0 /etc/cron.daily w=0 e=0 /var/spool/cron w=1 e=1 /tmp w=1 e=1 /var/tmp w=1 e=1 /home/sathwell/tmp w=1 e=1 /home/sathwell/public_html w=1 e=1 ==== softaculous installations snip ==== a:2:{s:8:"26_60792";a:21:{s:3:"sid";i:26;s:3:"ver";s:5:"6.9.4";s:5:"itime";i:1760498873;s:8:"softpath";s:26:"/home/sathwell/public_html";s:7:"softurl";s:28:"https://superwelljuniors.com";s:10:"softdomain";s:20:"superwelljuniors.com";s:9:"fileindex";a:21:{s:9:"index.php";s:9:"index.php";s:11:"license.txt";s:11:"license.txt";s:11:"readme.html";s:11:"readme.html";s:15:"wp-activate.php";s:15:"wp-activate.php";s:8:"wp-admin";s:8:"wp-admin";s:18:"wp-blog-header.php";s:18:"wp-blog-header.php";s:20:"wp-comments-post.php";s:20:"wp-comments-post.php";s:20:"wp-config-sample.php";s:20:"wp-config-sample.php";s:10:"wp-content";s:10:"wp-content";s:11:"wp-cron.php";s:11:"wp-cron.php";s:11:"wp-includes";s:11:"wp-includes";s:17:"wp-links-opml.php";s:17:"wp-links-opml.php";s:11:"wp-load.php";s:11:"wp-load.php";s:12:"wp-login.php";s:12:"wp-login.php";s:11:"wp-mail.php";s:11:"wp-mail.php";s:15:"wp-settings.php";s:15:"wp-settings.php";s:13:"wp-signup.php";s:13:"wp-signup.php";s:16:"wp-trackback.php";s:16:"wp-trackback.php";s:10:"xmlrpc.php";s:10:"xmlrpc.php";s:9:".htaccess";s:9:".htaccess";s:13:"wp-config.php";s:13:"wp-config.php";}s:9:"site_name";s:17:"Superwell Juniors";s:6:"softdb";s:20:"sathwell_superwellDB";s:10:"softdbuser";s:20:"sathwell_superwellUN";s:10:"softdbhost";s:14:"localhost:3306";s:10:"softdbpass";s:16:"Jt%twrf&7*~T21T5";s:9:"dbcreated";b:1;s:8:"dbprefix";s:4:"spw_";s:10:"import_src";s:10:"manual_ins";s:5:"insid";s:8:"26_60792";s:11:"script_name";s:9:"WordPress";s:23:"softaculous_pro_license";s:30:"SOFTWP-86496-73282-34646-58347";s:11:"blog_public";s:1:"1";s:8:"wp_debug";s:5:"false";s:15:"disable_wp_cron";b:0;}s:8:"26_30421";a:21:{s:3:"sid";i:26;s:3:"ver";s:5:"6.9.4";s:5:"itime";i:1760502534;s:8:"softpath";s:41:"/home/sathwell/public_html/prevail.com.my";s:7:"softurl";s:22:"https://prevail.com.my";s:10:"softdomain";s:14:"prevail.com.my";s:9:"fileindex";a:21:{s:9:"index.php";s:9:"index.php";s:11:"license.txt";s:11:"license.txt";s:11:"readme.html";s:11:"readme.html";s:15:"wp-activate.php";s:15:"wp-activate.php";s:8:"wp-admin";s:8:"wp-admin";s:18:"wp-blog-header.php";s:18:"wp-blog-header.php";s:20:"wp-comments-post.php";s:20:"wp-comments-post.php";s:20:"wp-config-sample.php";s:20:"wp-config-sample.php";s:10:"wp-content";s:10:"wp-content";s:11:"wp-cron.php";s:11:"wp-cron.php";s:11:"wp-includes";s:11:"wp-includes";s:17:"wp-links-opml.php";s:17:"wp-links-opml.php";s:11:"wp-load.php";s:11:"wp-load.php";s:12:"wp-login.php";s:12:"wp-login.php";s:11:"wp-mail.php";s:11:"w ==== WP users try via mysqli ==== DB sathwell_superwellDB connect=OK WP {"ID":"1","user_login":"superwell_admin","user_email":"support@superwelljuniors.com","user_pass":"$2y$10$3jfp8sf5VOBKZpFP1dqA4OeI3H1J.26oRSxcCuQQ27dxLv65XLl3G"} DB sathwell_prevail_db connect=OK WP {"ID":"1","user_login":"admin_z5h4txkz","user_email":"admin@prevail.com.my","user_pass":"$2y$10$3jfp8sf5VOBKZpFP1dqA4OeI3H1J.26oRSxcCuQQ27dxLv65XLl3G"} DB sathwell_superwelljuniors_cma connect=OK ==== php.ini / .user.ini ==== -- /home/sathwell/sathwell.com/php.ini -- ; cPanel-generated php ini directives, do not edit ; Manual editing of this file may result in unexpected behavior. ; To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor) ; For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI) disable_functions = exec,shell_exec,passthru,system,proc_open,popen,parse_ini_file,show_source,socket_create_listen,socket_create,syslog -- /home/sathwell/sathwell.com/.user.ini -- ; cPanel-generated php ini directives, do not edit ; Manual editing of this file may result in unexpected behavior. ; To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor) ; For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI) -- /home/sathwell/public_html/.user.ini -- DONE