403Webshell
Server IP : 202.61.199.114  /  Your IP : 216.73.217.139
Web Server : nginx/1.22.1
System : Linux de.arni-solutions.de 6.1.0-49-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.174-1 (2026-05-26) x86_64
User : web20 ( 1018)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /proc/3951572/root/usr/sbin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /proc/3951572/root/usr/sbin/unhide_rb
ELF>P)@R@8
@@@@��   @@@�	�	`L`\`\�pLp\p\��888  XXXDDS�td888  P�td H H H<<Q�tdR�td`L`\`\��/lib64/ld-linux-x86-64.so.2GNU��GNU�(Q*��f�	Q���GNU1�1(��e�m��aG�:_5 �7u���B���t��
�Q 2�y�#I-�zY*��` ��&�k��`"__cxa_finalizefgets__printf_chkmallocsysinfostat__isoc99_fscanf__libc_start_maingetpgidsched_getschedulerfputsfopengetsidfclose__strncat_chkstrcpystrtolmemsetsched_getparam__snprintf_chk__ctype_b_locgetuidsched_getaffinitystdout__strcat_chkclosedirpclosefreefflushstrstr__strcpy_chkstrncpystrlensched_rr_get_intervalgetpriority__sprintf_chkmemcpyopendirstrerror__errno_locationexitpopenreaddirreadlink__stack_chk_failfeoflibc.so.6GLIBC_2.3GLIBC_2.14GLIBC_2.33GLIBC_2.4GLIBC_2.7GLIBC_2.34GLIBC_2.2.5GLIBC_2.3.4_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable	�ii
	���������ii
�ii
���ui	ti	)`\0*h\�)`` `NA(`QA0`XA8`eA@`rAH`{AP`�AX`�A``�Ah`�Ap`�A�_�_	�_�_+�_2�`1x^�^�^�^�^�^�^�^
�^�^�^
�^�^�^�^�^�^____ _(_0_8_@_H_P_X_ `_!h_"p_#x_$�_%�_&�_'�_(�_)�_*�_,�_-�_.�_/�_0H��H��?H��t��H����5B>�%D>@�%B>h����%:>h�����%2>h����%*>h����%">h����%>h����%>h����%
>h�p����%>h�`����%�=h	�P����%�=h
�@����%�=h�0����%�=h� ����%�=h
�����%�=h�����%�=h���%�=h����%�=h�����%�=h����%�=h����%�=h����%�=h����%�=h����%�=h�p����%�=h�`����%z=h�P����%r=h�@����%j=h�0����%b=h� ����%Z=h�����%R=h�����%J=h���%B=h ����%:=h!�����%2=h"����%*=h#����%"=h$����%=h%����%=h&����%
=h'�p����%=h(�`����%�<h)�P����%�<h*�@����%�<h+�0����%=f�AW��AVAUATI��H�5nU��SH��IH��H��dH�%(H�D$x1��<���H�����H���H��H)�H�5��*���H�����H���H��H)�H�5
����H���p���H���H��H)�H�5���H���N���H���H��H)�H�5!����H���,���H���H��H)�H�5����H���
���H���H��H)�H�5%���H�����H���H��H)�H�53�^���H������H���H��H)�H�5A�<���H�����H���H��H)�H�5o����H�����H���H��H)�H�5���H���`���H���H��H)�H�5�����H���>���H���H��H)�H�5����H������H���H��H)�H�5����H�����H���H��H)�H�5��p���H������H���H��H)�H�5��N���H�����H���H��H)�H�5 �,���H�����H���H��H)�H�5@�
���H���r���H���H��H)�H�5 ���H���P���H���H��H)�H�5; ����H���.���H���H��H)�H�5A ���H������H���H��H)�H�5 ���H�����H���H��H)�H�5� �`���H������H���H��H)�H�5� �>���H�����H���H��H)�H�5� ����H�5:H���vL����H�=�9�j���������uH�=� ����H�=�9�E����O9��~@H��L�%PB1�H��L��L�-AB���H��1�L������H�-(BH��1�H���k�����1H���Y����D$P;~9tIH�=� ����j9H�5�1������T$P�1�H�5�����H�=9���H�=��G���������-D�=�8��E����D��L�%�A1�H��L��L�-qAH�����1�H��L���������E1�H�-IAA��~f�fDI�<�H��t
�Z���I��I�|�H��t�C���I�D�H�|�H��t�+���H�D�H��9�7�E����H�=��q���1�H�T$xdH+%(��H�Ĉ[]A\A]A^A_Ã�u�H�=��8������=w7~��E1�H�-v@fDH�|�t������t*�F7H��9�ރ��_���L�%>@L�-7@���H�=+<A����H�=y7��붸�����9���I�$H�5��1�����H�=J7������;�������fD1�I��^H��H���PTE1�1�H�=�����g6�f.�@H�=�6H��6H9�tH�F6H��t	�����H�=�6H�5�6H)�H��H��?H��H�H�tH�6H��t��fD�����=�6u+UH�=�5H��tH�=�5�����d����e6]������w����AW�>1�AVAUATUSH���|$H��$�dH�%(H��$�H�/proc/H��$�H��$�1��H�H��$�DŽ$�oc/H��H�$�=���I��f.�L������H��H�����{u���H�SH��H��DPt�H�����1�L��$�I��H�
�L������H�<$H�5��%���I��H��t:L�l$ �fDL�⾀L���@���H����L���?�����t�L���s���L��I��H�
�1����L��$��M���H�<$L�5�=�M���I��f.�L���(���H����H�HH�U�DJt�H�XL�$�L��1�I��H�
-�����L��L�����H���t��|$�81�H�ߺ
���H�
�<L��H�����H���z���f�L���(���L��Ƅ$��x���H��H���`���@L��H�-�L��$����H�5xH�����H���DH�ھ�L�����H����H������t�H��tH���V�H��$�dH+%(�0H�Ę[]A\A]A^A_�DA�}ppidƄ$��;���A�}:�0����
H�|$%1���H��;Hcȉ��
���@1��
H��A�H�D$�W�H�L$H�D$H�y�t�H�T$1�H��H�
�;H�Ѻ
�%�H�
~;L��H�<�������D��$�
Ƅ$���1�L��
���L��$�H��L��I�����H��������2�|$tMc�H�;J��������L�����I�D���� w(H��������H��H�H���u��H�H���� v=L��Mc���L�xL���v�L��L��H��H��:J�<��=��)����H��s���AWA����A��AVAUATUSH��dH�%(H��$�1�����	H��$�L�D$P�T$0Mc�H�D$H��$H�\$`H�D$H�D$LL��$�H�D$ H��$��D$8H�D$D�\$4L�D$(�H��9E��E��D��J�<�L�l$�H�
����2��L��D$`1��Y�H�t$L�����u��$(%�=@���D$dH�b9��J�<������D$hH�J9B�<�����D$l�W��������D$p�c�D�����1����D$t�|�H�t$ ��������D$x�3�H�T$����������D$|�U���������$���H�t$(���������$����������������$�H������t=H��I9��W���u�����t��u݃�tH��I9��3����tȃ�u�A��L�%541�1�H�
{���L�����L�t$8D�l$4�f�H���|H����E��H�L����LD�H��H�g/�PH��.H�
�L��H�=�;1��a��H�5�;L����XZH��H��tND�4�A���t��/A����z���H���]���H�V7J�4�H���]����LH�=�.�8��G����|$4�L�t$8��D$8I��D9|$0�1���H��$�dH+%(�z�D$8H��[]A\A]A^A_�@H�|$�2H�5�
�D$dL�-�6���H�|$��L���Q����t;H�H��$��L��A�D������H�s6J�4�H�������u���H�unknown DŽ$�exeH��$�����H��$����fo
H��$��|$H�5
H���D$P)�$�fo��$���D�\$H��H���kL�D$PH��1�D�\$L��H�5
�P�D�\$��uf�D$P��~^��,H��D�\$�[�D�\$��,H�5��1�D�\$�T$���T$�D$8���W���D�\$A�����I����1�H�-:9��D�\$L�!H���A�H�5z,H���B�D�\$�`���L�����H�hH�����H��4J����s4@��uN���������0�@���������A�T,�f�T(�������H��L��I�L�H�L��M����H��m�����0��A�T,��T(��U����c���H�g8�8���L�!
��H��I�����1��]�H�5�+H���^�D�\$���H��H���%s/statusrppid:%s/task/%s%s/exeps axhHo lwp,cmdSeen byNot seen bypid_max : %0d
/proc/%d
  %s %s %sSuspicious PID %5d:Unhide_rb 20211016
WARNING : 
 This was evidently false:
 - and so on.
You must be root to run %s !
  ps: %d processes
  sysinfo(): %d processes
Phase 1...Phase 2...No hidden processes found!ps/proc /proc_tasks /proc_parentgetsid()getpgid()getpriority()sched_getparam()sched_getaffinity()sched_getscheduler()sched_rr_get_interval()[*] Error: cannot get current maximum PID: %s
[*] cannot get current maximum PID: Error parsing %s format
Copyright © 2013-2021 Yago Jesus & Patrick Gouin
License GPLv3+ : GNU GPL version 3 or later
http://www.unhide-forensics.info

NOTE : This version of unhide_rb is for systems using Linux >= 2.6 

TL;DR : This tool is a P.O.F. (proof of fake).
        DON'T USE IT for serious work.

 Back in time, the Dev of unhide.rb pretends that his tool, written in ruby
 do the same checks that unhide-linux, which is written in C, but is 10 times faster.
 - unhide.rb makes less tests,
 - unhide.rb tests are less accurate,
 - unhide.rb displays only displays minimal information about hidden processes,
 - unhide.rb find lot of false positives when processes number is high,
 - unhide.rb find lot of false positives when there are short live processes,
 - unhide.rb don't log results of tests,
 In order to verify assertion about speed, I backported unhide.rb to C language,
 in the more straight/dummy way:
 No optimisation, translation from line to line, exactly the same tests and treatments.
 The result is native unhide_rb.
 It is ONE THOUSAND times faster that the original ruby unhide.rb

 So, don't rely neither on unhide.rb nor on unhide_rb, they are just toys ! 
 For a quick but quite accurate test, use the command 'unhide-linux quick reverse'

Scanning for hidden processes...ps and sysinfo() process count mismatch:
/proc/sys/kernel/kernel/pid_max;<����������x0�X ����zRx���"zRx�$p���FJw�?;*3$"D��L\P�hB�I�B �B(�A0�A8�G�
�
8A0A(B BBBF\�p�LB�J�B �B(�A0�A8�G���M�u�A��
8A0A(B BBBEL`��JB�G�B �B(�K0�F8�Q�=
8A0A(B BBBA0*�)� 
�4`\h\���o���
z`^ �
�	���o���op���o�o
���op\6 F V f v � � � � � � � � !!&!6!F!V!f!v!�!�!�!�!�!�!�!�!""&"6"F"V"f"v"�"�"�"�"�"�"�"`�NAQAXAeArA{A�A�A�A�A�A/usr/lib/debug/.dwz/x86_64-linux-gnu/unhide.debugP����I����i�9b28512a1401b2b91a66e6ff091e5115bfa8b3.debug�E�.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink88 &XX$9|| G���o��(Q���Y��za���o

fn���opp�}��B�
�
 �  �    ���"�"�##���4�4	�@@ � H H<�`H`H��`\`L�h\hL�p\pL��`^`N��`Px ��`xP� �xPF
�P4�P

Youez - 2016 - github.com/yon3zu
LinuXploit