Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cpanel-forensics — Форензика после CVE-2026-41940 (cPanel/WHM) — bash-скрипт и чек-лист | Kitploit
Tools/GitHubGitHub/ngksiva/cpanel-forensics
Vulnerability AnalysisConfiguration AuditingForensicsDigital ForensicsIncident ResponseLog Analysis
GitHubngksiva/cpanel-forensics

cpanel-forensics

Форензика после CVE-2026-41940 (cPanel/WHM) — bash-скрипт и чек-лист

View Repository
74 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

cPanel/WHM Forensics after CVE-2026-41940

Bash script for checking a server after the CVE-2026-41940 vulnerability (CVSS 9.8). For 64 days attackers had root access without a password — the patch does not remove what has already been planted inside.

Usage

root@kitploit:~
sudo bash cpanel_forensics.sh

The report is saved to /tmp/forensics_report_DATE.txt

What it checks

  • SSH authorized_keys for all users
  • Users with UID 0
  • Rootkits via ld.so.preload
  • Aliases, PATH, command substitution
  • zsh/bash autostart
  • Cron, systemd units
  • Network activity, processes with a deleted binary
  • Web shells, .sorry files
  • MySQL: secure_file_priv, plugin_dir, UDF, triggers, privileges, binary logs

Cybersecurity channel: t.me/safebdv

Download Tool