#1747836175
ls
#1747836218
cd ~
#1747836220
ls
#1776056695
cd krishivgroups.in/
#1776056713
cat wp-includes/version.php | grep wp_version
#1776056722
rm -rf wp-admin wp-includes
#1776056730
wp core download --force --skip-content --version=6.9.1
#1776058211
find . -type d -exec chmod 755 {} \;
#1776058225
find . -type f -exec chmod 644 {} \;
#1776058263
rm -rf wp-admin wp-includes
#1776058266
wp core download --force --skip-content --version=6.9.1
#1776087451
cd /home2/birthday/public_html/wp-content/themes/seomy/functions.php
#1776087460
cd /home/birthday/public_html/wp-content/themes/seomy/functions.php
#1776087473
cd home/birthday/public_html/wp-content/themes/seomy/functions.php
#1776087481
cd home2/birthday/public_html/wp-content/themes/seomy/functions.php
#1776087496
cd /home2/birthday
#1776087505
cd public_html/
#1776087511
cd wp-content
#1776087515
cd themes/
#1776087519
cd seomy/
#1776087544
php -l functions.php
#1776147580
cd public_html/
#1776147672
cat wp-includes/version.php | grep wp_version
#1776147678
rm -rf wp-admin wp-includes
#1776147693
wp core download --force --skip-content --version=6.9.4
#1778154019
cd public_html/
#1778154099
cat wp-includes/version.php | grep wp_version
#1778154106
rm -rf wp-admin wp-includes
#1778154118
wp core download --force --skip-content --version=6.9.4
#1778154251
mysql -u birthday_wp222 -p birthday_wp222
#1778169278
cd public_html
#1778169287
ll
#1778169317
cd blog/
#1778169325
ll
#1781264964
ls
#1781264967
pwd
#1781264974
cd public_html/
#1781264975
ls
#1781264977
ll
#1781265049
#!/bin/bash
#1781265049
WEBROOT="/home2/birthday/public_html"
#1781265049
cd "$WEBROOT"
#1781265049
echo "====== STEP 1: Check .htaccess files for redirects ======"
#1781265049
find . -name ".htaccess" -exec echo "--- {} ---" \; -exec cat {} \;
#1781265049
echo ""
#1781265049
echo "====== STEP 2: Scan PHP files for common malware patterns ======"
#1781265049
echo "--- base64_decode injections ---"
#1781265049
grep -rl "base64_decode" . --include="*.php" | grep -v "/wp-includes/" | head -30
#1781265050
echo "--- eval(base64 ---"
#1781265050
grep -rl "eval(base64_decode" . --include="*.php" | head -20
#1781265050
echo "--- gzinflate / str_rot13 ---"
#1781265050
grep -rl "gzinflate\|str_rot13\|gzuncompress" . --include="*.php" | head -20
#1781265050
echo "--- Suspicious redirect functions ---"
#1781265050
grep -rl "header.*Location" . --include="*.php" | grep -v "/wp-includes/" | grep -v "/wp-admin/" | head -20
#1781265050
echo "--- Recently modified PHP files (last 30 days) ---"
#1781265050
find . -name "*.php" -mtime -30 -not -path "*/wp-includes/*" | head -40
#1781265050
echo ""
#1781265050
echo "====== STEP 3: Check wp-config.php for tampering ======"
#1781265050
head -5 wp-config.php
#1781265050
echo ""
#1781265050
echo "====== STEP 4: Check active plugins ======"
#1781265050
ls wp-content/plugins/
#1781265050
echo ""
#1781265050
echo "====== STEP 5: Check themes ======"
#1781265065
ls wp-content/themes/
#1781265685
curl -s https://raw.githubusercontent.com/Nsharma-04/wp-core-replace/main/wp-core-replace.sh | bash
#1781267358
wp db query "SELECT ID, post_title, post_name, post_status FROM wp_posts WHERE post_name='services';" --path=/home2/birthday/public_html
#1781267460
wp post get YOUR_POST_ID --field=post_content --path=/home2/birthday/public_html | head -50
#1781267477
# Find any post/page still containing malware keywords
#1781267478
wp db query "SELECT ID, post_title, post_type FROM wp_posts WHERE post_content LIKE '%HOKBENTOTO%' OR post_content LIKE '%kiwkiwamtrsu%' OR post_content LIKE '%slot%' OR post_content LIKE '%toto%';" --path=/home2/birthday/public_html
#1781267513
wp db query "SELECT ID, post_title, post_name, post_status FROM wpkq_posts WHERE post_name='services';" --path=/home2/birthday/public_html
#1781267604
wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -50
#1781267621
wp post get 8063 --field=post_content --path=/home2/birthday/public_html | head -50
#1781267728
wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -100
#1781267734
wp post get 4056 --field=post_content --path=/home2/birthday/public_html | head -200
#1781267819
wp post delete 4056 --force --path=/home2/birthday/public_html
#1781267838
wp db query "SELECT ID, post_title, post_name, post_status FROM wpkq_posts WHERE post_name='services';" --path=/home2/birthday/public_html
#1781267846
wp rewrite flush --path=/home2/birthday/public_html
#1781267848
echo "✅ Permalinks flushed"
#1781267861
wp db query "SELECT ID, post_title, post_name, post_status, post_type FROM wpkq_posts WHERE post_content LIKE '%HOKBENTOTO%' OR post_content LIKE '%kiwkiwamtrsu%' OR post_content LIKE '%slot%gacor%' OR post_name LIKE '%toto%';" --path=/home2/birthday/public_html
#1781267889
wp db query "SELECT ID, post_title, post_name, post_date, post_modified FROM wpkq_posts WHERE post_status='publish' ORDER BY post_modified DESC LIMIT 20;" --path=/home2/birthday/public_html
#1781267988
# Check each of these for injected content
#1781267988
for ID in 8962 43 8296 8297 10094; do   echo "=== POST ID: $ID ===";   wp post get $ID --field=post_content --path=/home2/birthday/public_html | head -20;   echo ""; done
#1781268026
echo "=== FOOTER 480 (modified today) ==="
#1781268026
wp post get 480 --field=post_content --path=/home2/birthday/public_html
#1781268027
echo ""
#1781268027
echo "=== HEADER 168 (modified today) ==="
#1781268027
wp post get 168 --field=post_content --path=/home2/birthday/public_html
#1781268602
find /home2/birthday/public_html -name "*.js" -mtime -1 | grep -v "node_modules\|cache" | head -20
#1781268620
wp db query "SELECT post_id, meta_key, LEFT(meta_value,200) FROM wpkq_postmeta WHERE meta_value LIKE '%kiwkiwamtrsu%' OR meta_value LIKE '%HOKBENTOTO%' OR meta_value LIKE '%eval(%';" --path=/home2/birthday/public_html
#1781268634
find /home2/birthday/public_html/wp-content/themes/ -name "*.php" -mtime -1 | xargs grep -l "kiwkiwamtrsu\|HOKBENTOTO\|base64_decode\|eval(" 2>/dev/null
#1781269266
wp post delete 4056 --force --path=/home2/birthday/public_html
#1781269267
wp rewrite flush --path=/home2/birthday/public_html
#1781269268
echo "✅ Done"
#1781269284
wp db query "SELECT post_id, meta_key, LEFT(meta_value, 500) FROM wpkq_postmeta WHERE post_id=4056 AND meta_key LIKE '%elementor%';" --path=/home2/birthday/public_html
#1781269293
wp db query "SELECT meta_key, LEFT(meta_value, 300) FROM wpkq_postmeta WHERE post_id=8063 AND meta_value LIKE '%slot%';" --path=/home2/birthday/public_html
#1781269305
# WP Super Cache
#1781269305
wp cache flush --path=/home2/birthday/public_html
#1781269307
# Clear Elementor cache if active
#1781269307
wp elementor flush-css --path=/home2/birthday/public_html 2>/dev/null
#1781269309
# Clear any server-side cache folder
#1781269309
rm -rf /home2/birthday/public_html/wp-content/cache/* 2>/dev/null
#1781269309
echo "✅ Cache cleared"
#1781269374
curl -I https://krishivgroups.com/services/
#1781269401
curl -I https://krishivgroups.com/
#1782545175
du -sch * | sort -h
#1782545238
cd wapi.krishivgroups.com/
#1782545241
du -sch * | sort -h
#1782545245
cd public/
#1782545248
du -sch * | sort -h
#1782545253
cd uploads/
#1782545260
du -sch * | sort -h
#1782545281
cd media/
#1782545285
du -sch * | sort -h
#1782545300
du -sch * | grep G
#1782545306
cd ..
#1782545317
du -sch * | grep HG
#1782545321
du -sch * | grep G
#1782545325
cd uploads/
#1782545328
du -sch * | grep G
#1782545349
cd ..
#1782545350
ll
#1782545372
ls
#1782545381
cd
#1782545428
cd wapi.krishivgroups.com/
#1782545452
du -sch .[!.]* * | sort -h
#1782545459
cd public/
#1782545462
du -sch .[!.]* * | sort -h
#1782545469
cd uploads/
#1782545473
du -sch .[!.]* * | sort -h
#1782545491
pwd
#1782545659
cd
#1782545705
df -hT
#1782545715
du -sch * 
#1782545729
cd wapi.krishivgroups.com/
#1782545732
du -sch * 
#1782545761
cd public/
#1782545763
du -sch * 
#1782545772
cd uploads/
#1782545775
du -sch * 
#1782545802
du -sch * | grep G
#1782545831
du -sch .[!.]* * | sort -h
#1782545853
pwd
#1782559637
cd ~
#1782559760
tar -czf wapi.krishivgroups.com.tar.gz wapi.krishivgroups.com
#1782709044
du -sch *
#1782709118
cd wapi.krishivgroups.com
#1782709121
du -sch *
#1782709155
rm -rf ziqUCfKA 
#1782709165
rm -rf ziHgjTOT 
#1782709171
du -sch *
#1782709189
cd public/
#1782709192
du -sch *
#1782709196
cd uploads/
#1782709202
du -sch (
#1782709206
du -sch *
#1782709219
du -sch * | grep G
#1782975359
cd wapi.krishivgroups.com
#1782975361
php artisan migrate
#1782975374
php artisan config:clear
#1782976257
cd wapi.krishivgroups.com
#1782976730
php artisan migrate
#1782977121
php artisan route:clear
#1782977121
php artisan config:clear
#1782977121
php artisan cache:clear
#1783056839
cd wapi.krishivgroups.com
#1783056845
crontab -l
#1783056879
php artisan cache:clear
#1783056884
php artisan queue:work --stop-when-empty -v
#1783057013
php artisan cache:clear