GIF89a=( õ' 7IAXKgNgYvYx\%wh…hŽth%ˆs%—x¨}9®Œ©€&©‰%¶†(¹–.¹5·œD¹&Çš)ÇŸ5ǘ;Í£*È¡&Õ²)ׯ7×µ<Ñ»4ï°3ø‘HÖ§KͯT÷¨Yÿšqÿ»qÿÔFØ !ù ' !ÿ NETSCAPE2.0 , =( þÀ“pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§gª«ªE¯°¨¬ª±²Œ¹º¹E¾­”´ÂB¶¯ §Åȸ»ÑD¾¿Á•ÄÅ®° ÝH¾ÒLÀÆDÙ«D¶BÝïðÀ¾DÑÑÔTÌÍíH òGö¨A RÎڐ |¥ ٭&ºìE8œ¹kGÔAÞpx­a¶­ã R2XB®åE8I€Õ6Xî:vT)äžþÀq¦è³¥ì仕F~%xñ  4#ZÔ‰O|-4Bs‘X:= QÉ œš lºÒyXJŠGȦ|s hÏíK–3l7·B|¥$'7Jީܪ‰‡àá”Dæn=Pƒ ¤Òëí‰`䌨ljóá¯Éüv>á–Á¼5 ½.69ûϸd«­ºÀûnlv©‹ªîf{¬ÜãPbŸ  l5‘Ž¯pß ´ ˜3aÅùäI«O’ý·‘áÞ‡˜¾Æ‚ÙÏiÇÿ‹Àƒ #öó)pâš Þ½ ‘Ý{ó)vmÞü%D~ 6f s}ŃƒDØW Eþ`‡þ À…L8xá†ç˜{)x`X/> Ì}mø‚–RØ‘*|`D=‚Ø_ ^ð5 !_…'aä“OÚ—7âcð`D”Cx`ÝÂ¥ä‹éY¹—F¼¤¥Š?¡Õ™ n@`} lď’ÄÉ@4>ñd œ à‘vÒxNÃ×™@žd=ˆgsžG±æ ´²æud &p8Qñ)ˆ«lXD©øÜéAžHìySun jª×k*D¤LH] †¦§C™Jä–´Xb~ʪwStŽ6K,°£qÁœ:9ت:¨þªl¨@¡`‚ûÚ ».Û¬¯t‹ÆSÉ[:°=Š‹„‘Nåû”Ìî{¿ÂA ‡Rà›ÀÙ6úë°Ÿð0Ä_ ½;ÃϱîÉì^ÇÛÇ#Ëë¼ôº!±Ä˜íUîÅÇ;0L1óÁµö«p% AÀºU̬ݵ¼á%霼€‡¯Á~`ÏG¯»À× ­²± =4ªnpð3¾¤³¯­ü¾¦îuÙuµÙ®|%2ÊIÿür¦#0·ÔJ``8È@S@5ê¢ ö×Þ^`8EÜ]ý.뜃Âç 7 ú ȉÞj œ½Dç zý¸iþœÑÙûÄë!ˆÞÀl§Ïw‹*DçI€nEX¯¬¼ &A¬Go¼QföõFç°¯;é¦÷îŽêJ°îúôF5¡ÌQ|îúöXªæ»TÁÏyñêï]ê² o óÎC=öõ›ÒÓPB@ D×½œä(>èCÂxŽ`±«Ÿ–JЀ»Û á¤±p+eE0`ëŽ`A Ú/NE€Ø†À9‚@¤à H½7”à‡%B‰`Àl*ƒó‘–‡8 2ñ%¸ —€:Ù1Á‰E¸àux%nP1ð!‘ðC)¾P81lÑɸF#ˆ€{´âé°ÈB„0>±û °b¡Š´±O‚3È–Ù()yRpbµ¨E.Z‘D8ÊH@% òŒx+%Ù˜Æcü »¸˜fõ¬b·d`Fê™8èXH"ÉÈ-±|1Ô6iI, 2““¬$+](A*jÐ QTÂo‰.ÛU슬Œã„Ž`¯SN¡–¶Äåyše¯ª’­¬‚´b¦Éož œ)åyâ@Ì®3 ÎtT̉°&Ø+žLÀf"Ø-|žçÔ>‡Ðv¦Ðžì\‚ Q1)Ž@Žh#aP72”ˆ™¨$‚ !ù " , =( …7IAXG]KgNgYvYxR"k\%w]'}hŽth%ˆg+ˆs%—r.—m3šx3˜x¨}9®€&©€+¨‡7§‰%¶†(¹–.¹œD¹&ǘ;Í•&ײ)×»4ïÌ6ò§KÍ þ@‘pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g «¬ E ±± ¨­¶°ººE Á´”·®C¬²§Ç¶Œ»ÓDÃÕƷ¯Ê±H½ºM×ÁGÚ¬D¶BËÁ½î½DÓôTÏÛßîG»ôõC×CÌ l&âž:'òtU³6ɹ#·Ø)€'Ü.6±&ëÍÈ» K(8p0N?!æ2"ÛˆNIJX>R¼ÐO‚M '¡¨2¸*Ÿþ>#n↠å@‚<[:¡Iïf’ ¤TÚ˘CdbÜÙ“[«ŽEú5MBo¤×@€`@„€Êt W-3 ¶Ÿ¡BíêäjIÝ…Eò9[T…$íêﯧ„…•s»Óȳ¹€ÅÚdc®UUρ#±Ùïldj?´í¼²`\ŽÁðÞu|3'ÖŒ]ë6 ¶S#²‡˜FKLÈ *N E´‘áäŠ$˜›eÄYD„ºq«.è촁ƒs \-ÔjA 9²õ÷å- üúM[Âx(ís÷ì®x€|í¡Ù’p¦‚ ŽkÛTÇDpE@WÜ ²Ç]kŠ1¨ þ€·Yb ÓÁ‰l°*n0 ç™—žzBdОu¾7ĉBl€â‰-ºx~|UåU‰  h*Hœ|e"#"?vpÄiŠe6^ˆ„+qâŠm8 #VÇá ‘å–ÄV„œ|Šè•m"сœn|@›U¶ÆΞ—Špb¥G¨ED”€±Úê2FÌIç? >Éxå Œ± ¡¤„%‘žjŸ‘ꄯ<Ìaà9ijÐ2˜D¦È&›†Z`‚å]wþ¼Â:ç6àB¤7eFJ|õÒ§Õ,¨äàFÇ®cS·Ê¶+B°,‘Þ˜ºNûãØ>PADÌHD¹æž«ÄÀnÌ¥}­#Ë’ë QÀÉSÌÂÇ2ÌXÀ{æk²lQÁ2«ÊðÀ¯w|2Í h‹ÄÂG€,m¾¶ë3ÐÙ6-´ÅE¬L°ÆIij*K½ÀÇqï`DwVÍQXœÚÔpeœ±¬Ñ q˜§Tœ½µƒ°Œìu Â<¶aØ*At¯lmEØ ü ôÛN[P1ÔÛ¦­±$ÜÆ@`ùåDpy¶yXvCAyåB`ŽD¶ 0QwG#¯ æš[^Äþ $ÀÓÝǦ{„L™[±úKÄgÌ;ï£S~¹ìGX.ôgoT.»åˆ°ùŸûù¡?1zö¦Ÿž:ÅgÁ|ìL¹ „®£œŠ‚à0œ]PÁ^p F<"•ç?!,ñ‡N4—…PÄ Á„ö¨Û:Tè@hÀ‹%táÿ:ø-žI<`þ‹p I….)^ 40D#p@ƒj4–؀:²‰1Øâr˜¼F2oW¼#Z†;$Q q” ‘ ÂK¦ñNl#29 !’F@¥Bh·ᏀL!—XFóLH‘Kh¤.«hE&JòG¨¥<™WN!€ÑÙÚˆY„@†>Œž19J" 2,/ &.GXB%ÌRÈ9B6¹W]’î×ÔW¥’IÎ$ ñ‹ÓŒE8YÆ ¼³™ñA5“à®Q.aŸB€&Ø©³ JÁ—! ¦t)K%tœ-¦JF bòNMxLôþ)ÐR¸Ð™‘ èÝ6‘O!THÌ„HÛ ‰ !ù ) , =( …AXKgNgYvYxR"k\%wh…hŽh%ˆg+ˆs%—r.—x3˜x¨}9®€&©€+¨Œ,©‡7§‰%¶†(¹–.¹5·&Çš)ǘ;Í•&×£*Ȳ)ׯ7×»4ï°3øÌ6ò‘HÖ§KÍ»Hó¯T÷¨Yÿ»qÿÇhÿ þÀ”pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g ª« E$±²¨ª­ · °²½$E$ÂÕ««D· Í ¿¦Ç¶¸ÌŒ¾³CÃÅÆ E ééH½MÛÂGâªD­ çBêêϾD²ÒaÀà€Š1r­ðÓ¤ ÔožzU!L˜C'¾yW½UGtäÇïÙllê0×àÂuGþ)AÀs[þ·xì ÁxO%ƒûX2ó—  P£n›R/¡ÑšHše+êDm?# —‘Ç£6¡8íJ¡ŸâDiäªM¥Ö„ôj“¬¹£5oQ7°- <‡ *´lãÓŒ2r/a!l)dÈ A™ÈE¢ôÔ͆…ð ;Ö˜c ¡%ß‚’Ùˆâ¸b½—pe~C"BíëÚHïeF2§æŠ8qb t_`urŠeü wÅu3êæPv§h•"ß`íÍxçLĹÜÖ3á  ~Öº“®›¸ÏMDfJÙ °„ÛµáWõ%§œ‚à©–‚X Ó؁)@®Ñ›Eþ´wëuÅSxb8y\mÖzœ¥§ZbºE—ÂLªÌw!y(>¡™wú=Ç|ÅÝs¢d €CÁW)HÜcC$€L Ä7„r.á\{)@ð` @ äXÈ$PD” `šaG:§æˆOˆ72EÐamn]ù"ŒcÊxÑŒ° &dR8`g«iÙŸLR!¦P …d’ä¡“¦ðÎTƒ¦ià|À _ ¥ Qi#¦Šg›Æ ›noMµ ›V ã£)p ç£ÎW…š=Âeªk§†j„ ´®1ß²sÉxéW«jšl|0¯B0Û, \jÛ´›6±¬¶C ÛíWþï|ëÙ‹¸ñzĸV {ì;Ýñn¼òVˆm³I¼³.Ðã¤PN¥ ²µ¼„µCã+¹ÍByî£Ñ¾HŸ›ëê 7ìYÆFTk¨SaoaY$Dµœìï¿Ã29RÈkt Çïfñ ÇÒ:ÀÐSp¹3ÇI¨â¥DZÄ ü9Ïýögñ½­uÔ*3)O‘˜Ö[_hv ,àî×Et Ÿé¶BH€ Õ[ü±64M@ÔSÌM7dÐl5-ÄÙU܍´©zߌ3Ô€3ž„ „ ¶ÛPô½5×g› êÚ˜kN„Ý…0Îj4€Ìë°“#{þÕ3S2çKÜ'ợlø¼Ú2K{° {Û¶?žm𸧠ËI¼nEò='êüóºè^üæÃ_Û=°óž‚ì#Oý¿Í'¡½áo..ÏYìnüñCœO±Áa¿¢Kô½o,üÄËbö²çºíï{ËC Ú— "”Ï{ËK ÍÒw„õ±Oz dÕ¨à:$ ƒô—«v»] A#ð «€¿šéz)Rx׿ˆ¥‚d``èw-îyÏf×K!ð€þ­Ð|ìPľ„=Ì`ý(f” 'Pa ¥ÐBJa%Ðâf§„%Š¡}FàáÝ×6>ÉäŠG"éŽè=ø!oŠ°^FP¼Ø©Q„ÀCÙÁ`(Ž\ÄÝ® ©Â$<n@dÄ E#ììUÒI! ‚#lù‹`k¦ÐÇ'Rró’ZýNBÈMF Í[¤+‹ðɈ-áwj¨¥þ8¾rá ,VÂh„"|½œ=×G_¦Ñ™EØ 0i*%̲˜Æda0mV‚k¾)›;„&6 p>ÓjK “¦Ç# âDÂ:ûc?:R Ó¬fÞéI-Ì“•Ã<ä=™Ï7˜3œ¨˜c2ŒW ,ˆ”8(T™P‰F¡Jhç"‚ ; 403WebShell
403Webshell
Server IP : 172.67.177.218  /  Your IP : 216.73.216.82
Web Server : LiteSpeed
System : Linux premium229.web-hosting.com 4.18.0-553.45.1.lve.el8.x86_64 #1 SMP Wed Mar 26 12:08:09 UTC 2025 x86_64
User : akhalid ( 749)
PHP Version : 8.3.22
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /opt/imunify360/venv/share/imunify360/scripts/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /opt/imunify360/venv/share/imunify360/scripts/imunify-doctor.sh
#!/bin/bash
VERSION="8.5.1"
LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8
LANGUAGE=en_US.UTF-8
DEST=/root/cl-report
UPLOAD_URL=https://doctor.cloudlinux.com/doctor/upload
CAT=`command -v cat`
UNAME=`command -v uname`
CP="Unknown"
SERVER_ID=
main_ip='NA'
scriptname="imunify-doctor"
IMUNIFY360_PIDFILE=/var/run/imunify360.pid
IMUNIFY360_AGENT_PIDFILE=/var/run/imunify360-agent.pid
# custom tmp dir from imunify360.spec for symlink attack prevention
tmpdir=/var/imunify360/tmp
sqlite_path=/opt/alt/sqlite/usr/bin/sqlite3
IMUNIFY360_DB=/var/imunify360/imunify360.db
IMUNIFY360_RESIDENT_DB=/var/imunify360/imunify360-resident.db
IMUNIFY360_IPLIST_DB=/var/imunify360/imunify360-ipsetlists.db
db_command="$sqlite_path $IMUNIFY360_DB"
db_command_resident="$sqlite_path $IMUNIFY360_RESIDENT_DB"
db_command_iplist="$sqlite_path $IMUNIFY360_IPLIST_DB"


cleanup() {
  rm -f $DEST $DEST.wget
}

test_curl() {
    command -v curl >/dev/null 2>&1
    return $?
}

test_wget() {
  command -v wget >/dev/null 2>&1
  if [ 0 -eq $? ]; then
    if [ -x `command -v wget` ]; then
	return 0
    fi
  fi
  return 1
}

curl_upload() {
 curl -s -H "serverid: $SERVER_ID" -F reportfile=@"$DEST" $UPLOAD_URL
}

wget_upload() {

    echo -e "--FILEUPLOAD\r\n" > $DEST.wget
    echo -e "--FILEUPLOAD\r\n" > $DEST.wget
    echo -e "Content-Disposition: form-data; name=\"reportfile\"; filename=\"$DEST\"\r\n" >> $DEST.wget
    echo -e "Content-Type: application/octet-stream\r\n" >> $DEST.wget
    echo -e "Media Type: application/octet-stream\r\n\r\n" >> $DEST.wget
    cat $DEST >> $DEST.wget
    echo -e "--FILEUPLOAD--\r\n" >> $DEST.wget
    wget -O - -qq -t 1 --header="serverid: $SERVER_ID" --header="Content-type: multipart/form-data; boundary=FILEUPLOAD" --post-file $DEST.wget $UPLOAD_URL
}

get_server_id() {
  SERVER_ID=$(/opt/imunify360/venv/bin/python -c 'import json; import sys; print(json.load(sys.stdin)["id"])' < /var/imunify360/license.json)
  if [[ -z "$SERVER_ID" ]]; then
    SERVER_ID="${main_ip//./_}"
  fi
}

init_main_ip() {
 if test_curl
 then
    main_ip=`curl -s -L http://cloudlinux.com/showip.php` 2>/dev/null
 else
    main_ip=`wget -qq -O - http://cloudlinux.com/showip.php` 2>/dev/null
 fi
}

get_main_ip() {
  sep "Main IP"
  echo "$main_ip" >> $DEST
  echo >>$DEST
}


upload() {
 if test_curl
 then
     curl_upload
 else
     wget_upload
 fi
}

report_error_and_exit() {
 echo "$1"
 exit 1
}

mecho(){
 echo $1 >> $DEST
}
start(){
 if ! test_wget; then
     if ! test_curl; then
	 echo "Cannot find wget or curl"
     fi
     #echo "Using curl"
 fi
 echo "------ CL INFO ---" > $DEST
}

time_stamp(){
 echo "" >> $DEST
 echo "TS: $(date)" >> $DEST
}

sep(){
 echo "------ $1 ---" >> $DEST
}


run(){
 sep "$1"
 sh -c "$1" >> $DEST 2>&1
 time_stamp
}

run_cb(){
 sep "$1"
 $1 >> $DEST 2>&1
 result=$?
 time_stamp
 return $result
}

dump() {
 sep "cat $1"
 $CAT $1  >> $DEST 2>&1
 echo >> $DEST 2>&1
 time_stamp
}


detect_cp() {
    CP_VERSION="Unknown"
    SOFTACULOUS=0
    if [ -d "/usr/local/psa/admin/" ]; then
	    CP="Plesk"
        CP_VERSION=`cat /usr/local/psa/version`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/cpanel/whostmgr/docroot/" ]; then
	    CP="cPanel"
        CP_VERSION=`/usr/local/cpanel/cpanel -V`
	    if [ -e "/usr/local/cpanel/whostmgr/cgi/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/interworx/" ]; then
	    CP="InterWorx"
        CP_VERSION=`cat /usr/local/interworx/iworx.ini|grep version`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/ispmgr/" ]; then
	    CP="ISPmanager"
        CP_VERSION=`/usr/local/ispmgr/bin/ispmgr -v`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/directadmin/plugins/" ]; then
	    CP="DirectAdmin"
        CP_VERSION=`/usr/local/directadmin/custombuild/build versions|sed -n 2p|cut -d":" -f2`
	    if [ -e "/usr/local/directadmin/plugins/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/hostingcontroller/" ]; then
	    CP="Hosting Controller"
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/hsphere/shared" ]; then
        CP="H-Sphere"
    fi
    sep "Control Panel"
    mecho "CP: $CP"
    mecho "VERSION: $CP_VERSION"
    mecho "SOFTACULOUS: $SOFTACULOUS"
}

detect_httpd() {

    PERL_BIN=$(which perl 2>>/dev/null)

    echo
    echo "HTTP Server Running Processes: "
    echo

    IFS=$(echo -en "\n\b")
    for proc in $(ps -eo pid,user,group,cmd 2>>/dev/null | egrep "\b(httpd|apache2|litespeed|lshttpd)\b" | grep -v "egrep"); do
        echo "[$proc]"
        proc_pid=$(echo "$proc" | awk '{print$1}')
        echo "Bin:" $(readlink "/proc/${proc_pid}/exe" 2>>/dev/null)
        echo "Environment:"
        cat "/proc/${proc_pid}/environ"  2>>/dev/null | tr '\0' '\n' | head -30
        echo
    done
    unset IFS
    echo

    http_bins=$(ps -eo pid,comm 2>>/dev/null | egrep "\b(httpd|apache2)\b" | awk '{print "/proc/"$1"/exe"}' | xargs -n 1 readlink | uniq | egrep "\b(httpd|apache2)\b")

    for http_bin in "$http_bins"; do

        if [ -z "$http_bin" ]; then
            continue
        fi

        echo "HTTP Binary Info: "
        echo -e "$http_bin\n"
        $http_bin -V 2>&1
        echo
        $http_bin -M 2>&1
        echo

        if [ -z "$PERL_BIN" ]; then
            continue
        fi

        httpd_root=$($http_bin -V | grep HTTPD_ROOT | cut -d= -f2 | tr -d '"' )
        httpd_config=$($http_bin -V | grep SERVER_CONFIG_FILE | cut -d= -f2 | tr -d '"' )

        if [ -z "$httpd_config" ]; then
            continue
        fi

        if [ ! ${httpd_config:0:1} = "/" ]; then
            httpd_config="$httpd_root/$httpd_config"
        fi

        pl_script_path="$(dirname $(readlink -e "$0"))/mk_apache_conf_digest.pl"
        if [ -e "$pl_script_path" ]; then
            echo "Server Configs:"
            $PERL_BIN "$pl_script_path" "$httpd_config" "$httpd_root" 2>>/dev/null
        fi

    done

}


http_server_info() {
    detect_httpd 2>>/dev/null | head -5000
}


backup_systems_info() {
    if [ ! -f /var/restore_infected/acronis_api_token.json ]; then
        echo "/var/restore_infected/acronis_api_token.json: no such file."
    else
        echo "/var/restore_infected/acronis_api_token.json: "
        # "username": "AB-99658-51"
        /opt/imunify360/venv/bin/python -m json.tool < /var/restore_infected/acronis_api_token.json
    fi

    echo
    echo "imunify360-agent backup-systems extended-status: "
    imunify360-agent backup-systems extended-status -v --json | tee $tmpdir/backup_systems_info.$$
    /opt/imunify360/evnv/bin/python >$tmpdir/backup_systems_info.$$.current <<ENDPY
import json
print(json.load(open("$tmpdir/backup_systems_info.$$"))["items"]["backup_system"])
ENDPY

    rm $tmpdir/backup_systems_info.$$
    rm $tmpdir/backup_systems_info.$$.current
}


webshield_selfcheck() {
    /usr/share/imunify360-webshield/self_check.py
}


pam_db_size() {
    mod_db_path=$(awk -F= '$1 == "mod_db_path" {print $2}' /etc/pam_imunify/i360.ini)
    du --human-readable --summarize "$mod_db_path"
}

version() {
    sep "Version of doctor script"
    echo "Version: $VERSION" >> $DEST
}

trap cleanup EXIT

start
version
init_main_ip
get_main_ip
get_server_id
detect_cp
run "date"
run "$CAT /proc/cpuinfo"
run "$UNAME -a"
run "$UNAME -r"
run "$UNAME -m"
run "$UNAME -p"
run "$UNAME -o"
dump "/etc/redhat-release"
dump "/etc/os-release"
dump "/var/imunify360/license.json"
dump "/etc/sysconfig/imunify360/imunify360.config"
dump "/etc/sysconfig/imunify360/imunify360-merged.config"
run "tail -n +1 /etc/sysconfig/imunify360/imunify360.config.d/*"
dump "/etc/sysconfig/imunify360/cpanel/imunify360.conf"
run "ls -lhaR /var/lib/unified-access-logger"
run "du -hs0 /var/lib/unified-access-logger"
run "tail -n3000 /var/log/imunify360/console.log"
run "tail -n3000 /var/log/imunify360/debug.log"
run "tail -n3000 /var/log/imunify360/network.log"
run "tail -n3000 /var/log/imunify360/acronis-installer.log"
run "tail -n3000 /var/log/imunify360/error.log"
run "tail -n3000 /var/log/imunify360-webshield/access.log"
run "tail -n3000 /var/log/imunify360-webshield/error.log"
run "tail -n3000 /var/ossec/logs/alerts/alerts.log"
run "tail -n3000 /usr/local/directadmin/custombuild/custombuild.log"
run "tail -n3000 /var/log/patchman/patchman.log"
dump "/etc/issue"
dump "/etc/sysconfig/kernel"
dump "/etc/sysconfig/kcare/systemid"
dump "/proc/uptime"
dump "/proc/loadavg"
dump "/proc/vmstat"
dump "/proc/devices"
dump "/proc/diskstats"
dump "/proc/cmdline"
dump "/proc/mdstat"
dump "/proc/meminfo"
dump "/proc/swaps"
dump "/proc/filesystems"
dump "/proc/mounts"
dump "/proc/interrupts"
dump "/boot/grub/grub.conf"
dump "/proc/version"
dump "/etc/passwd"

run "ls -la /etc/apt/sources.list.d/"
run "tail -n 50 /etc/apt/sources.list.d/*imunify*"
run "ls -la /etc/apt/preferences.d/"
run "tail -n 50 /etc/apt/preferences.d/*"

run "zgrep -C 5 imunify /var/log/apt/history.log*"
run "zgrep -C 5 imunify /var/log/apt/term.log*"
run "apt policy imunify360-firewall"

run "ls -la /etc/yum.repos.d/"
run "tail -n 50 /etc/yum.repos.d/{*imunify360*,*sensor*}"
run "grep DEFAULT /etc/default/grub"
run "grep vmlinuz /boot/grub2/grub.cfg| sed 's/root=.*//'"
dump "/boot/grub2/grub.cfg"
dump "/proc/zoneinfo"
run "ls /etc/grub.conf /boot/grub/grub.conf /boot/grub/menu.lst"
run "ls -l /boot"
run "grep Port /etc/ssh/sshd_config"
run "dmidecode"
run "systemd-detect-virt"
run "virt-what"
run "ipcs -m|sed -e s/-/=/g"
run "sysctl -a"
dump "/etc/sysctl.conf"
run 'rpm -q -a --queryformat="%{N}|%{V}-%{R}|%{arch}\n"'
packages=$(rpm -qa imunify* 2>>/dev/null)
for package in $packages; do
    run "rpm -V $package"
done

run "dpkg -l"
run "tail -n10000 /var/log/messages"
run "ls -lR /var/cache/kcare/"
dump "/etc/sysconfig/kcare/kcare.conf"
dump "/etc/kdump.conf"
run "/opt/imunify360/venv/bin/python -m pip freeze"
[[ -f "$IMUNIFY360_PIDFILE" ]] && run "echo ${IMUNIFY360_PIDFILE}; ls -l /proc/$(cat ${IMUNIFY360_PIDFILE})/fd"
[[ -f "$IMUNIFY360_AGENT_PIDFILE" ]] && run "echo ${IMUNIFY360_AGENT_PIDFILE}; ls -l /proc/$(cat ${IMUNIFY360_AGENT_PIDFILE})/fd"


run "df -h"
dump "/etc/userdomains"

run "ps aux --sort=-%mem | head -20"
run "ps aux --sort=-%cpu | head -20"
run "ps aux | grep -i imunify"

run "crontab -l"
run "service imunify360 status"
run "service imunify-antivirus status"
run "service imunify360-webshield status"
run "service wsshdict status"
run "service firewalld status"
run "service ossec-hids status"
run "service fail2ban status"
run "service httpd status"
run "service lshttpd status"
run "service patchman-client status"

run_cb "webshield_selfcheck"

run_cb "pam_db_size"
run "imunify360-pam status --yaml"
run "ls -la /etc/pam.d/"
run "cat /etc/pam_imunify/i360.ini"

if [ -e "/usr/sbin/csf" ]; then
  run "csf --status"
  run "lfd --status ; echo $?"
  run "service lfd status"
  run "service csf status"
  run "csf -V"
  dump "/etc/csf/csf.conf"
  dump "/etc/csf/csf.deny"
  dump "/etc/csf/csf.allow"
  dump "/etc/csf/csf.ignore"
  run "tail -n3000 /var/log/lfd.log"
fi
run "cxs --version"

if [ -e "/usr/bin/firewall-cmd" ]; then
    run "timeout 5 firewall-cmd -V"
    run "timeout 5 firewall-cmd --state"
    run "tail -n3000 /var/log/firewalld"
fi

run "service cpanel status"
dump "/var/cpanel/dnsonly"
run "service mysql status"
run "ps aux | grep -i cphulk"

run "ipset -V"
run "ipset save | head -n3000"
run "ipset list -t | head -n3000"
run "iptables -V"
run "iptables-save | head -n3000"

run "ifconfig"
run "echo .tables | $db_command"
run "echo \"select plugin, count(*) from incident;\" | $db_command_resident"
run "echo \"select listname, count(*) from iplist;\" | $db_command_resident"
run "echo \"select iplist_id, count(*) from iplistrecord;\" | $db_command_iplist"
run "echo \"select * from iplist order by ctime desc limit 1000;\" | $db_command_resident"
run "echo \"select * from incident order by timestamp desc limit 1000;\" | $db_command_resident"
run "echo \"select * from country limit 1000;\" | $db_command"
run "echo \"select * from country_list order by ctime desc limit 1000;\" | $db_command"
run "echo \"select * from last_synclist limit 1000;\" | $db_command_resident"
run "echo \"select * from migratehistory limit 1000;\" | $db_command"
run "echo \"select * from malware_hits limit 1000;\" | $db_command"
run "echo \"select * from malware_ignore_path limit 1000;\" | $db_command"
run "echo \"select * from malware_scans limit 1000;\" | $db_command"
run "du --human-readable /var/imunify360/imunify360.db"
run "imunify360-agent blacklist country list --json --limit 2000"
run "imunify360-agent blacklist ip list --json --limit 2000"
run "imunify360-agent graylist ip list --json --limit 2000"
run "imunify360-agent whitelist country list --json --limit 2000"
run "imunify360-agent whitelist ip list --json --limit 2000"

run "imunify360-agent rstatus"
run "imunify360-agent version"
run "imunify360-agent 3rdparty conflicts --json | /opt/imunify360/venv/bin/python -m json.tool"
run "imunify360-agent config show --json -v"
run "grep License /var/log/imunify360/console.log | tail -n 1000"
run "grep 'Server is offline' /var/log/imunify360/console.log | tail -n 1000"
run "grep 'SensorAlert' /var/log/imunify360/console.log | tail -n 3000"
run "grep 'modsec' /var/log/imunify360/console.log | tail -n 3000"
run "ls -la /etc/sysconfig/imunify360/"
run_cb "backup_systems_info"

run "tail -n3000 /var/log/i360deploy.log"
run "tail -n3000 /var/log/imav-deploy.log"
run "tail -n3000 /var/ossec/logs/active-responses.log"
run "tail -n3000 /var/ossec/logs/alerts/alerts.log"
run "tail -n3000 /var/log/yum.log"
run "tail -n3000 /var/log/minidaemon.log"

# cPanel
run "tail -3000 /usr/local/apache/logs/error_log"
run "tail -3000 /usr/local/apache/logs/access_log"
run "tail -3000 /usr/local/apache/logs/modsec_audit.log"
# EA4
run "tail -3000 /etc/apache2/logs/modsec_audit.log"
# plesk
run "tail -3000 /usr/local/apache/logs/modsec_audit.log"
# DA
run "tail -3000 /var/log/httpd/modsec_audit.log"

run "tail -3000 /var/log/trueimage-setup.log"

run "/usr/local/cpanel/scripts/modsec_vendor list"
run "whmapi1 modsec_get_configs"
run "whmapi1 modsec_get_settings"
run "cat /etc/apache2/conf.d/modsec2.imunify.conf"
run "cat /usr/local/apache/conf/includes/modsec2.imunify.conf"
run "ls /var/cpanel/cwaf"

# prepend each particular log with ==> logfilename <== string
run "tail --lines +0 /var/log/imunify360/register_unregister_post_error_*.log"

# prepend each particular log with ==> logfilename <== string
run "tail --lines +0 /var/log/imunify360/*hardenedphp.log.*"
run "tail --lines +0 /var/log/imunify360/*kernelcare.log*"
run "tail --lines +0 /var/log/imunify360/*ea_php.log*"
run "ls /opt/alt/php*/usr/bin/php"
run "ls /opt/cpanel/ea-php*/root/usr/bin/php"
run 'rpm -qa --queryformat "%{NAME} %{RELEASE}\n" "ea-php*"'

run "getenforce"
run "sestatus"
run "ss -u -a"
run "ss -x -a | grep defence360agent"
run "nc -v -w 5 -i 1 imunify360.cloudlinux.com 443"
run "nc -v -w 5 -i 1 148.251.142.83 443"
dump "/usr/local/cpanel/version"
run "ls /etc/rc.d/init.d/"
run "systemctl list-units --all"
run "systemctl status aibolit-resident.socket"
run "curl ipinfo.io"
run "netstat -tulpan | tail -n 3000"
run "netstat -tulpan | wc -l"
# only tcp listening sockets & program
run "netstat -tlpn"
run "lsmod | grep ip_set"
dump "/etc/cagefs/cagefs.mp"
for f in /var/log/imunify360/native_da.hook_log.*
do dump $f
done

### PLESK
run "/usr/local/psa/admin/sbin/modsecurity_ctl --list-rules"
run "/usr/local/psa/admin/sbin/modsecurity_ctl --list-rules --enabled"
run "/usr/local/psa/admin/sbin/modsecurity_ctl --status"
run "/usr/local/psa/bin/server_pref --show-web-app-firewall"

run_cb "http_server_info"
# collect info on how huge /var/cpanel/secdatadir/ip.pag is
run "ls -lh /var/cpanel/secdatadir/*"
run "printenv"

run "/usr/libexec/run-with-intensity show"

# colect webshield  info
run "tail -3000 /var/log/wsshdict/wsshdict.log"
run "tail -3000 /var/log/imunify360/imunify360-wafd.log"

# collect UAL log
run "tail -3000 /var/log/imunify360/imunify360-unified-access-logger/log.rotate"

if [ -e "/etc/kdump.conf" ]; then
  KDUMP_PATH=`grep ^path /etc/kdump.conf|cut -d' ' -f2`
  if [ -z "$KDUMP_PATH" ] ; then
    run "ls -lR /var/crash"
  else
    run "ls -lR $KDUMP_PATH"
  fi
fi
run dmesg

run "ls -la /var/ossec/etc/VERSIONS/"
run "ls --lcontext /var/ossec"
run "ls --lcontext /var/ossec/bin"
run "ls --lcontext /var/ossec/logs"

run "ls -la /etc/httpd/conf/modsecurity.d/rules/"
run "ls -la /etc/apache2/conf.d/modsec_vendor_configs/"

run "cat /etc/httpd/conf/modsecurity.d/rules/custom/VERSION"
run "cat /usr/local/directadmin/custombuild/custom/modsecurity/conf/VERSION"
run "cat /etc/apache2/conf.d/modsec_vendor_configs/imunify*/VERSION;echo"
run "cat /var/cpanel/modsec_cpanel_conf_datastore"

run "cut -d\":\" -f1 /etc/userplans | sort -n | uniq | wc -l"
run "cut -d\":\" -f1 /etc/userplans | sort -n | uniq"
run "cut -d\":\" -f2 /etc/virtual/domainowners | sort -n | uniq"
run "cut -d\":\" -f2 /etc/virtual/domainowners | sort -n | uniq | wc -l"
run "plesk db \"SELECT COUNT(DISTINCT cl_id) FROM domains\""
run "httpd  -t"

run "journalctl --no-pager -u imunify360 --since -1d"
run "journalctl --no-pager -u imunify360-agent --since -1d"
run "journalctl --no-pager -u imunify360-unified-access-logger --since -1d"

upload && echo || report_error_and_exit "Report file upload failed. Please try again."

Youez - 2016 - github.com/yon3zu
LinuXploit