Hunter Black Hat SEO
Server:LiteSpeed
System:Linux raton.hozzt.com 4.18.0-553.144.1.lve.el8.x86_64 #1 SMP Thu Jul 16 08:31:06 UTC 2026 x86_64
User:altinkayamarble (1260)
PHP:7.4.33
Disabled:symlink, show_source, system, virtual, shell_exec,passthru, exec, popen, proc_open, proc_close, proc_nice, proc_terminate,proc_get_status, pfsockopen,allow_url_fopen, posix_getpwuid, eval,posix_setsid, posix_mkfifo, posix_setpgid,posix_setuid, posix_uname,posix_kill,apache_child_terminate, apache_setenv,define_syslog_variables,escapeshellarg, escapeshellcmd, leak, dl, fp, fput,ftp_connect, ftp_exec,ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist,highlight_file, ini_alter, ini_get_all, ini_restore, inject_code
Upload Files
File: //var/softaculous/suitecrm/get_user.php
<?php

@unlink('get_user.php');

function __getRunningUser(){
    // works on Windows and Linux, but might return null on systems that include "exec" in
    // disabled_functions in php.ini (typical in shared hosting)
    $runningUser = exec('whoami');

    if ($runningUser == null) {  // matches null, false and ""
        if (__is_windows()) {
            $runningUser = getenv('USERDOMAIN').'\\'.getenv('USERNAME');
        } elseif (function_exists('posix_getpwuid') && function_exists('posix_geteuid')) {
            $usr = posix_getpwuid(posix_geteuid());
            $runningUser = $usr['name'];
        }
    }
    return ($runningUser == null) ? '' : $runningUser;
}

function __is_windows(){
	
    static $is_windows = null;
    if (!isset($is_windows)) {
        $is_windows = strtoupper(substr(PHP_OS, 0, 3)) == 'WIN';
    }

    return $is_windows;
}

	$cronUser = __getRunningUser();
	echo '<get_user>'.$cronUser.'</get_user>';
	
?>