shell bypass 403

GrazzMean Shell

: /var/www/html/ [ drwxr-xr-x ]
Uname: Linux p3plzcpnl499967.prod.phx3.secureserver.net 4.18.0-553.54.1.lve.el8.x86_64 #1 SMP Wed Jun 4 13:01:13 UTC 2025 x86_64
Software: Apache
PHP version: 8.2.30 [ PHP INFO ] PHP os: Linux
Server Ip: 208.109.40.231
Your Ip: 216.73.216.26
User: nayff91c5tsx (10005085) | Group: nayff91c5tsx (10005085)
Safe Mode: OFF
Disable Function:
NONE
upload mass deface mass delete console

name : updowncheck.php 
<!DOCTYPE html>
<html>
<head>
<title>Monitor Test Page</title>
</head>
<body>
<h1>This is a monitoring page.</h1>

<?php
// Track status for final summary
$php_passed = false;
$mysql_passed = false;

// --- 1. PHP Test ---
date_default_timezone_set('America/Phoenix');
echo '<p>PHP test passed; current time: ' . date("d F Y H:i:s O") . '</p>';
$php_passed = true;

 // Get server information for RUM
 $hostname = gethostname();
 if ($hostname === false) {
     $hostname = php_uname('n');
     if ($hostname === false) {
         $hostname = '';
     }
 }

 // Determine application code based on hostname
 if (strpos($hostname, 'mcpnl') !== false) {
     $ap = 'cpbh-mt';
 } elseif (strpos($hostname, 'zcpnl') !== false) {
     $ap = 'cpsh-oh';
 } else {
     $ap = 'cpsh';
 }
 
 // Determine environment and datacenter
 if (strpos($hostname, 'tl') !== false) {
     $basehost = 'test-secureserver.net';
     preg_match('/^(.+?)tl/', $hostname, $matches);
     $dcenter = $matches[1] ?? '';
 } else {
     // Production environment (default)
     $basehost = 'secureserver.net';
     preg_match('/^(.+?)pl/', $hostname, $matches);
     $dcenter = $matches[1] ?? '';
 }
 
 // Get CloudLinux version
 $cl_version = '';
 if (file_exists('/etc/redhat-release')) {
     $release = file_get_contents('/etc/redhat-release');
     if ($release !== false && preg_match('/([0-9])[.]/', $release, $matches)) {
         $cl_version = $matches[1];
     }
 }

// --- 2. MySQL Test ---
$config_file = '../db_config.php';

if (!file_exists($config_file)) {
    echo '<p><strong>MySQL failed:</strong> config file not found at ' . htmlspecialchars($config_file) . '</p>';
} elseif (!class_exists('mysqli')) {
    echo '<p><strong>MySQL failed:</strong> mysqli extension not found.</p>';
} else {
    include($config_file);

    // CRITICAL CHECK: Handle the "Empty Password" scenario specifically
    if (empty($db_pass)) {
        echo '<p><strong>MySQL failed:</strong> Password variable is empty in config file.</p>';
    } else {
        try {
            // Using @ to suppress notices, but the try/catch handles the Fatal Exceptions
            $conn = @new mysqli($db_host, $db_user, $db_pass);

            if ($conn->connect_error) {
                echo '<p><strong>MySQL failed:</strong> Connection Error (' . $conn->connect_errno . ') ' . $conn->connect_error . '</p>';
            } else {
                $result = $conn->query("SELECT 2+2 AS result");
                $row = $result ? $result->fetch_assoc() : null;

                if ($row && $row['result'] == 4) {
                    echo '<p>MySQL test passed</p>';
                    $mysql_passed = true;
                } else {
                    echo '<p><strong>MySQL failed:</strong> Incorrect query response.</p>';
                }
                $conn->close();
            }
        } catch (Exception $e) {
            // This catches PHP 8.1+ mysqli exceptions (like Access Denied) 
            // that would otherwise stop script execution.
            echo '<p><strong>MySQL failed (Exception):</strong> ' . $e->getMessage() . '</p>';
        }
    }
}

// --- 3. Final Summary Logic ---
echo '<hr><br>';
if ($php_passed && $mysql_passed) {
    echo '<strong>All tests have passed</strong>';
} else {
    // Determine specific failure for the monitoring system to scrape
    $failed = [];
    if (!$php_passed) $failed[] = "PHP";
    if (!$mysql_passed) $failed[] = "MySQL";
    echo '<strong>Critical Failure: ' . implode(" and ", $failed) . ' test(s) failed.</strong>';
    
    // Set a non-200 HTTP header so external monitors (Icinga/UptimeRobot) see the failure
    http_response_code(500);
}
 // Set fixed cPanel user ID for gdlinuxm canary account
 $cp_id = '100001';
?>
<script>
'undefined'=== typeof _trfq || (window._trfq = []);
'undefined'=== typeof _trfd && (window._trfd=[]);
_trfd.push(
  {'tccl.baseHost': <?php echo json_encode($basehost); ?>},
  {'ap': <?php echo json_encode($ap); ?>},
  {'server': <?php echo json_encode($hostname); ?>},
  {'dcenter': <?php echo json_encode($dcenter); ?>},
  {'cp_id': <?php echo json_encode($cp_id); ?>},
  {'cp_cl': <?php echo json_encode($cl_version); ?>}
);
// Monitoring performance to make your website faster. If you want to opt-out, please contact web hosting support.
</script>
<script src='https://img1.wsimg.com/traffic-assets/js/tccl.min.js'></script>
</body>
</html>
© 2026 GrazzMean