During a rutine malware cleanup a file named hax.html caught my attention.
On the outside the file was a simple “you’re hacked page” that looked like this:
But with a POST method sent to it a nice little web shell opens up:
default password for this shell is: myshell
Source: github
![Screen Shot 2020 06 23 at 09.57.51 - WARNING: [pool user_USERNAME] server reached pm.max_children setting (25), consider raising it](https://i0.wp.com/administrator.pejcic.rs/wp-content/uploads/2026/09/Screen-Shot-2020-06-23-at-09.57.51.png?resize=344%2C194&ssl=1 "WARNING: [pool user_USERNAME] server reached pm.max_children setting (25), consider raising it")
