Aurora
Adminer
Auto Root
WP Admin
cPanel Reset
Anti Backdoor
Root
scripts
Upload
New Folder
New File
Name
Size
Permissions
Actions
..
-
-
-
Upload File
Select File
New Folder
Folder Name
New File
File Name
Add WordPress Admin
Database Host
Database Name
Database User
Database Password
Admin Username
Admin Password
cPanel Password Reset
Email Address
Edit: find_pids_with_inotify_watch_on_path
#!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/find_pids_with_inotify_watch_on_path # Copyright 2022 cPanel, L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited package scripts::find_pids_with_inotify_watch_on_path; use strict; use warnings; use parent qw( Cpanel::HelpfulScript ); use Cpanel::Version::Compare (); use Cpanel::OSSys (); use Cpanel::LoadFile (); use Cpanel::ProcessInfo (); my $PROC_PATH = '/proc'; =encoding utf-8 =head1 NAME scripts::find_pids_with_inotify_watch_on_path =head1 SYNOPSIS find_pids_with_inotify_watch_on_path <path> =head1 DESCRIPTION This command will look at /proc to find which process has an inotify watch on a specific path (inode) =cut __PACKAGE__->new(@ARGV)->script() unless caller(); sub _ACCEPT_UNNAMED { return 1; } sub _OPTIONS { } sub script { my ($self) = @_; my ($release) = ( Cpanel::OSSys::uname() )[2]; if ( !Cpanel::Version::Compare::compare( $release, '>=', '3.10' ) ) { die "Kernel version “$release” is too old to find inotify watches. Please upgrade to “3.10” or newer."; } my ($path) = $self->getopt_unnamed(); my ( $dev, $inode ) = ( stat($path) )[ 0, 1 ]; if ( !$inode ) { die "The system could not determine the inode for “$path”: $!"; } my $hexdev = sprintf( "%x", $dev ); my $hexinode = sprintf( "%x", $inode ); my %procs_holding_inotify; opendir( my $proc_dh, $PROC_PATH ) or die "opendir($PROC_PATH): $!"; my $binary_path; foreach my $proc ( grep { $_ !~ tr{0-9}{}c } readdir($proc_dh) ) { # Only has numbers so its a pid $binary_path = readlink("$PROC_PATH/$proc/exe") or next; # no file means it a kernel process that we always want to exclude # stat name is here. we don't want to ever kill kernel process so not used opendir( my $fd_dh, "$PROC_PATH/$proc/fd" ) or next; if ( my @inotify_fds = grep { $_ !~ tr{0-9}{}c && readlink("$PROC_PATH/$proc/fd/$_") =~ m{inotify}i } readdir($fd_dh) ) { foreach my $inotify_fd (@inotify_fds) { # use Cpanel::LoadFile::loadfile since it will not exception if the pid goes away while we # are reading my @lines = ( split( m{\n}, Cpanel::LoadFile::loadfile("$PROC_PATH/$proc/fdinfo/$inotify_fd") ) ); splice( @lines, 0, 3 ); my @data = map { { map { ( split( m{:}, $_ ) )[ 0, 1 ] } split( m{ }, $_ ) ## no critic qw(BuiltinFunctions::ProhibitVoidMap) } } @lines; foreach my $watch (@data) { if ( index( $watch->{'sdev'}, $hexdev ) == 0 && $watch->{'ino'} eq $hexinode ) { $procs_holding_inotify{$proc} = $watch->{'wd'}; last; } } } } next; } foreach my $proc ( sort keys %procs_holding_inotify ) { my $name = Cpanel::ProcessInfo::get_pid_cmdline($proc); my $exe; local $@; warn if !eval { $exe = Cpanel::ProcessInfo::get_pid_exe($proc); 1 }; my $watch_decimal = hex $procs_holding_inotify{$proc}; print "$name ($exe) is holding a inotify on $path (watch #$watch_decimal)\n"; } if ( !%procs_holding_inotify ) { print "No processes holding an inotify watch on $path\n"; } return; } 1;