=== Redis INFO === sh: line 1: redis-cli: command not found === Redis CONFIG === sh: line 1: redis-cli: command not found sh: line 1: redis-cli: command not found sh: line 1: redis-cli: command not found === Redis KEYS === sh: line 1: redis-cli: command not found === MySQL version and user === ERROR 1045 (28000): Access denied for user 'u610527261_intersafe_arm'@'127.0.0.1' (using password: YES) === MySQL UDF check === total 8688 drwxr-xr-x 4 root root 4096 Aug 11 2024 . drwxr-xr-x 3 root root 4096 Jun 5 2024 .. -rwxr-xr-x 1 root root 76144 Jun 5 2024 auth_ed25519.so -rwxr-xr-x 1 root root 15224 Jun 5 2024 auth_gssapi_client.so ls: cannot access '/usr/lib/mysql/plugin/': No such file or directory total 26360 drwxr-xr-x 3 root root 4096 Jul 9 2024 . drwxr-xr-x 3 root root 4096 Jul 9 2024 .. -rw-r--r-- 1 root root 215080 Jun 5 2024 auth_ed25519.so-10.11.8-1.module_el9.4.0+179+394c7fb5.x86_64.debug -rw-r--r-- 1 root root 37656 Jun 5 2024 auth_gssapi_client.so-10.11.8-1.module_el9.4.0+179+394c7fb5.x86_64.debug === CageFS token file === -r-------- 1 u610527261 root 16 Sep 23 2024 /var/.cagefs/.cagefs.token 4ruk93bRcmg3t5P8/var/.cagefs/.cagefs.token: ASCII text, with no line terminators 00000000: 3472 756b 3933 6252 636d 6733 7435 5038 4ruk93bRcmg3t5P8 === CageFS escape via mount === cat: /etc/cagefs/cagefs-base: No such file or directory ls: cannot access '/usr/share/cagefs/': No such file or directory no cagefsctl === Check /opt === total 120 drwxr-xr-x. 29 root root 4096 Apr 30 12:11 . drwxr-xr-x 13 root root 4096 Jun 26 07:10 .. drwxr-xr-x 3 root root 4096 Jul 9 2024 .wp-cli drwxr-xr-x 2 root root 4096 Jul 9 2024 MegaRAID drwxr-xr-x. 60 root root 4096 Apr 8 09:51 alt drwxr-xr-x 2 root root 4096 Jul 9 2024 app-version-detector drwx------ 3 root root 4096 Jan 23 2025 benchmark drwxr-xr-x 2 root root 4096 Jul 9 2024 bitninja-ssl-termination drwxr-xr-x. 22 root root 4096 Jun 27 17:35 cloudlinux drwxr-xr-x. 2 root root 4096 Jul 3 2024 cloudlinux-linksafe drwxr-xr-x 2 root root 4096 Jan 9 19:19 cloudlinux-site-optimization-module drwxr-xr-x 3 root root 4096 Jan 27 01:58 clwpos drwxr-xr-x. 24 root root 4096 Mar 31 19:06 cpanel drwxr-xr-x 3 root root 4096 Jul 9 2024 cpvendor drwxr-xr-x 3 root root 4096 Feb 19 03:32 fluent-bit -rw-r--r-- 1 root root 250 Jul 9 2024 frr.sh -rw-r--r-- 1 root root 0 Jul 9 2024 frr_install_done drwxr-xr-x 4 root root 4096 Jul 9 2024 go drwxr-xr-x 3 root root 4096 Jul 9 2024 golang drwxr-xr-x 5 root 89939 4096 Feb 11 2025 gsutil drwx------ 10 root root 4096 May 6 12:01 hs3 drwxr-xr-x 6 65538 1006 4096 Mar 25 2025 ipmi_exporter drwxr-xr-x. 2 root root 4096 Mar 19 15:48 liblve drwx--x--- 5 65542 1011 4096 Jul 9 2024 memcached_exporter drwxr-xr-x 6 root root 4096 Nov 20 2025 passenger drwxr-xr-x. 3 root root 4096 Jul 3 2024 plesk drwxr-xr-x 5 999923244 400 4096 Jun 22 02:59 process_exporter drwxr-xr-x 2 root root 4096 Jan 6 07:35 remi drwxr-xr-x 4 root root 4096 Jun 20 2025 restic drwxr-xr-x 3 root root 4096 Apr 30 12:11 rh drwxr-xr-x 26 975 1013 4096 Jun 1 13:29 sentinelone === Check processes for root services === u610527+ 3444569 0.0 0.0 4256 3280 ? S 19:40 0:00 sh -c ps aux 2>&1 | grep -i 'redis\|mysql\|mariadb\|httpd\|apache\|litespeed\|nginx' | head -15 u610527+ 3444571 0.0 0.0 3476 1948 ? S 19:40 0:00 grep -i redis\|mysql\|mariadb\|httpd\|apache\|litespeed\|nginx === /var/spool/cron access === total 8 drwx------ 2 u610527261 o1005873323 4096 Sep 23 2024 . drwxr-xr-x 3 root root 4096 Jul 9 2024 .. ls: cannot access '/etc/crontab': No such file or directory ls: cannot access '/etc/cron.d/': No such file or directory ls: cannot access '/etc/cron.hourly/': No such file or directory ls: cannot access '/etc/cron.daily/': No such file or directory === user home dir .ssh === total 24 drwx------ 2 u610527261 o1005873323 4096 Jan 9 13:12 . drwx--x--- 18 u610527261 apache 4096 Jun 25 10:49 .. -rw-r--r-- 1 u610527261 o1005873323 855 Sep 23 2024 known_hosts -rw-r--r-- 1 u610527261 o1005873323 101 Sep 23 2024 known_hosts.old total 24 drwx------ 2 u610527261 o1005873323 4096 Jan 9 13:12 . drwx--x--- 18 u610527261 apache 4096 Jun 25 10:49 .. -rw-r--r-- 1 u610527261 o1005873323 855 Sep 23 2024 known_hosts -rw-r--r-- 1 u610527261 o1005873323 101 Sep 23 2024 known_hosts.old DONE