8.3.36
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 1.9 0.4 177116 16892 ? Ss Oct23 115:34 /usr/lib/systemd/systemd --switched-root --system --deserialize 31 root 2 0.0 0.0 0 0 ? S Oct23 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? S Oct23 0:00 [pool_workqueue_] root 4 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-rcu_g] root 5 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-sync_] root 6 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-slub_] root 7 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-netns] root 9 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/0:0H-events_highpri] root 10 0.0 0.0 0 0 ? I Oct23 0:00 [kworker/u16:0-events_unbound] root 11 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-mm_pe] root 12 0.0 0.0 0 0 ? I Oct23 0:00 [kworker/u16:1-netns] root 13 0.0 0.0 0 0 ? I Oct23 0:00 [rcu_tasks_kthre] root 14 0.0 0.0 0 0 ? I Oct23 0:00 [rcu_tasks_rude_] root 15 0.0 0.0 0 0 ? I Oct23 0:00 [rcu_tasks_trace] root 16 0.0 0.0 0 0 ? S Oct23 2:21 [ksoftirqd/0] root 17 0.0 0.0 0 0 ? I Oct23 4:20 [rcu_preempt] root 18 0.0 0.0 0 0 ? S Oct23 0:00 [rcu_exp_par_gp_] root 19 0.0 0.0 0 0 ? S Oct23 0:06 [rcu_exp_gp_kthr] root 20 0.0 0.0 0 0 ? S Oct23 0:03 [migration/0] root 21 0.0 0.0 0 0 ? S Oct23 0:00 [idle_inject/0] root 23 0.0 0.0 0 0 ? S Oct23 0:00 [cpuhp/0] root 24 0.0 0.0 0 0 ? S Oct23 0:00 [cpuhp/1] root 25 0.0 0.0 0 0 ? S Oct23 0:00 [idle_inject/1] root 26 0.0 0.0 0 0 ? S Oct23 0:03 [migration/1] root 27 0.0 0.0 0 0 ? S Oct23 2:18 [ksoftirqd/1] root 29 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/1:0H-events_highpri] root 30 0.0 0.0 0 0 ? S Oct23 0:00 [cpuhp/2] root 31 0.0 0.0 0 0 ? S Oct23 0:00 [idle_inject/2] root 32 0.0 0.0 0 0 ? S Oct23 0:03 [migration/2] root 33 0.0 0.0 0 0 ? S Oct23 2:19 [ksoftirqd/2] root 35 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/2:0H-events_highpri] root 36 0.0 0.0 0 0 ? S Oct23 0:00 [cpuhp/3] root 37 0.0 0.0 0 0 ? S Oct23 0:00 [idle_inject/3] root 38 0.0 0.0 0 0 ? S Oct23 0:03 [migration/3] root 39 0.0 0.0 0 0 ? S Oct23 2:17 [ksoftirqd/3] root 41 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/3:0H-events_highpri] root 49 0.0 0.0 0 0 ? S Oct23 0:00 [kdevtmpfs] root 50 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-inet_] root 51 0.0 0.0 0 0 ? S Oct23 0:08 [kauditd] root 52 0.0 0.0 0 0 ? S Oct23 0:00 [khungtaskd] root 54 0.0 0.0 0 0 ? S Oct23 0:00 [oom_reaper] root 56 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-write] root 57 0.0 0.0 0 0 ? S Oct23 1:45 [kcompactd0] root 58 0.0 0.0 0 0 ? SN Oct23 0:00 [ksmd] root 59 0.0 0.0 0 0 ? SN Oct23 0:16 [khugepaged] root 60 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-crypt] root 61 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kinte] root 62 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kbloc] root 63 0.0 0.0 0 0 ? S Oct23 0:00 [irq/9-acpi] root 65 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-tpm_d] root 66 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-md] root 67 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-md_bi] root 68 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-edac-] root 69 0.0 0.0 0 0 ? S Oct23 0:00 [watchdogd] root 72 0.0 0.0 0 0 ? I< Oct23 0:09 [kworker/2:1H-kblockd] root 73 0.0 0.0 0 0 ? S Oct23 1:08 [kswapd0] root 90 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kthro] root 95 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-acpi_] root 96 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kmpat] root 97 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kalua] root 99 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-mld] root 100 0.0 0.0 0 0 ? I< Oct23 0:09 [kworker/1:1H-kblockd] root 101 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-ipv6_] root 106 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-kstrp] root 112 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/u21:0] root 113 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/u22:0] root 114 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/u23:0] root 115 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/u24:0] root 116 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/u25:0] root 263 0.0 0.0 0 0 ? I< Oct23 0:08 [kworker/0:1H-kblockd] root 416 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-ata_s] root 417 0.0 0.0 0 0 ? S Oct23 0:00 [scsi_eh_0] root 418 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-scsi_] root 419 0.0 0.0 0 0 ? S Oct23 0:00 [scsi_eh_1] root 420 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-scsi_] root 442 0.0 0.0 0 0 ? S Oct23 0:31 [jbd2/vda1-8] root 443 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-ext4-] root 530 0.0 0.3 46420 13088 ? Ss Oct23 3:07 /usr/lib/systemd/systemd-journald root 553 0.0 0.0 0 0 ? S Oct23 0:00 [jbd2/loop0-8] root 554 0.0 0.0 0 0 ? I< Oct23 0:00 [kworker/R-ext4-] rpc 569 0.0 0.1 14780 4548 ? Ss Oct23 0:00 /usr/bin/rpcbind -w -f root 571 0.0 0.0 20016 1836 ? Sroot 3785388 0.0 0.0 6644 1684 ? S 14:57 0:00 /usr/sbin/CROND -n root 3785390 0.0 0.0 6644 1684 ? S 14:57 0:00 /usr/sbin/CROND -n root 3785395 0.0 0.0 4620 3256 ? Ss 14:57 0:00 /bin/sh -c /usr/local/pinguzo/bin/pinguzo-agent.sh >> /var/log/pinguzo/agent.log 2>&1 root 3785398 0.0 0.0 4620 3276 ? Ss 14:57 0:00 /bin/sh -c /usr/bin/perl /usr/local/seclayer/crons.pl >> /var/seclayer/logs/crons.log 2>&1 root 3785404 0.5 0.4 19448 16496 ? S 14:57 0:00 /usr/bin/perl /usr/local/seclayer/crons.pl root 3785407 0.0 0.1 5412 4204 ? S 14:57 0:00 /bin/bash /usr/local/pinguzo/bin/pinguzo-agent.sh root 3785443 0.0 0.0 0 0 ? I 14:57 0:00 [kworker/0:1-rcu_gp] root 3785572 0.0 0.0 5412 2768 ? S 14:57 0:00 /bin/bash /usr/local/pinguzo/bin/pinguzo-agent.sh root 3786093 6.0 0.0 5592 3244 ? S 14:57 0:00 /bin/bash /usr/local/pinguzo/bin/pinguzo-agent.sh softuser 3789176 0.0 0.5 266392 21092 ? R 14:57 0:00 php-fpm: pool nuftp_com softuser 3789210 0.0 0.0 7272 3256 ? R 14:57 0:00 ps aux
Current Root Inode: 0 Realpath of /: / I can see /etc. Scanning for system files... CRITICAL: I can see /etc/shadow. Jailing FAILED. root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin systemd-coredump:x:999:996:systemd Core Dumper:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin tss:x:59:59:Account used for TPM access:/dev/null:/sbin/nologin sssd:x:998:995:User for sssd:/:/sbin/nologin chrony:x:997:994::/var/lib/chrony:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/sbin/nologin systemd-oom:x:992:992:systemd Userspace OOM Killer:/:/usr/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/usr/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin mailman:x:991:990:GNU Mailing List Manager:/usr/local/cpanel/3rdparty/mailman:/usr/local/cpanel/bin/noshell cpanel:x:990:989::/var/cpanel/userhomes/cpanel:/usr/local/cpanel/bin/noshell cpanelcabcache:x:989:988::/var/cpanel/userhomes/cpanelcabcache:/usr/local/cpanel/bin/noshell cpanellogin:x:988:987::/var/cpanel/userhomes/cpanellogin:/usr/local/cpanel/bin/noshell cpaneleximfilter:x:987:986::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell cpaneleximscanner:x:986:985::/var/cpanel/userhomes/cpaneleximscanner:/usr/local/cpanel/bin/noshell cpanelroundcube:x:985:984::/var/cpanel/userhomes/cpanelroundcube:/usr/local/cpanel/bin/noshell cpanelconnecttrack:x:984:983::/var/cpanel/userhomes/cpanelconnecttrack:/usr/local/cpanel/bin/noshell cpanelanalytics:x:983:982::/var/cpanel/userhomes/cpanelanalytics:/usr/local/cpanel/bin/noshell cpses:x:982:981::/var/cpanel/cpses:/sbin/nologin dovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologin dovenull:x:981:980:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologin mailnull:x:47:47:Exim:/var/spool/mqueue:/bin/false mysql:x:980:978:MariaDB server:/var/lib/mysql:/sbin/nologin cpanelphppgadmin:x:979:977:phpPgAdmin for cPanel & WHM:/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/cpanel/bin/noshell cpanelphpmyadmin:x:978:976:phpMyAdmin for cPanel & WHM:/var/cpanel/userhomes/cpanelphpmyadmin:/usr/local/cpanel/bin/noshell agent360:x:977:975::/home/agent360:/bin/false polkitd:x:976:973:User for polkitd:/:/sbin/nologin rtkit:x:172:172:RealtimeKit:/:/sbin/nologin rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin pipewire:x:975:972:PipeWire System Daemon:/run/pipewire:/usr/sbin/nologin geoclue:x:974:971:User for geoclue:/var/lib/geoclue:/sbin/nologin flatpak:x:973:970:Flatpak system helper:/:/usr/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin _imunify:x:972:969::/home/_imunify:/bin/false softuser:x:1001:1002::/home/softuser:/usr/local/cpanel/bin/noshell wp-toolkit:x:971:967::/usr/local/cpanel/3rdparty/wp-toolkit/var:/bin/false script:x:1002:1003::/home/script:/usr/local/cpanel/bin/noshell billing:x:1003:1004::/home/billing:/usr/local/cpanel/bin/noshell backuply:x:970:966::/home/backuply:/bin/bash simuzo:x:969:965::/home/simuzo:/bin/bash imp:x:1006:1007::/home/imp:/usr/local/cpanel/bin/noshell cpuser:x:1007:1008::/home/cpuser:/usr/local/cpanel/bin/noshell pooja:x:1008:1009::/home/pooja:/usr/local/cpanel/bin/noshell deepaknuftp:x:1009:1010::/home/deepaknuftp:/usr/local/cpanel/bin/noshell anil:x:1010:1011::/home/anil:/bin/bash ampps:x:1011:1012::/home/ampps:/usr/local/cpanel/bin/noshell sunil:x:1012:1013::/home/sunil:/bin/bash softtest:x:1013:1014::/home/softtest:/usr/local/cpanel/bin/noshell postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash simuzouser:x:1015:1016::/home/simuzouser:/bin/bash alicecp:x:1016:1017::/home3/alicecp:/bin/bash helpcp:x:1019:1020::/home/helpcp:/usr/local/cpanel/bin/noshell bobnuftp:x:1022:1023::/home/bobnuftp:/usr/local/cpanel/bin/noshell alicenuftp:x:1023:1024::/home/alicenuftp:/usr/local/cpanel/bin/noshell alex15:x:1024:1025::/home/alex15:/usr/local/cpanel/bin/noshell tcpdump:x:72:72::/:/sbin/nologin impostorage:x:1025:1026::/home2/impostorage:/usr/local/cpanel/bin/noshell wwe:x:1026:1027::/home/wwe:/usr/local/cpanel/bin/noshell seclayer:x:968:964::/home/seclayer:/sbin/nologin reseller:x:1028:1029::/home/reseller:/usr/local/cpanel/bin/noshell softacc1:x:1050:1051::/home/softacc1:/usr/local/cpanel/bin/noshell ygdywdg:x:1053:1054::/home/ygdywdg:/usr/local/cpanel/bin/noshell merre:x:1054:1055::/home/merre:/usr/local/cpanel/bin/noshell softaculous:x:967:963::/var/softaculous-data:/sbin/nologin