cpanel_cracker

The name is a lie. cpanel_cracker contains zero brute-force logic — no password lists, no login loops, no credential stuffing of any kind. It is a config grabber and system file reader, attributed via in-source watermarks (“Coded by Don / Made In Malaysia 2014”) consistent with the Donnazmi handle associated with AnonGhost. The misnomer is itself an intelligence signal: either the author aspired to capabilities they never implemented, or the name is inherited from a template that predates the actual code.

Capabilities

The core function is a symlink-based config grabber that targets approximately 120 hardcoded paths covering WordPress, Joomla, WHMCS, vBulletin, Drupal, osCommerce, ZenCart, SMF, HostBills, and dozens of other CMS and billing platforms. The symlink approach creates a filesystem alias from a readable directory to the target config file, bypassing open_basedir restrictions that would otherwise prevent cross-account file reads on shared hosting. A secondary module parses /etc/named.conf to enumerate all domains and their associated system users — a complete map of which domain belongs to which hosting account.

The tool includes a stealth-404 evasion layer: it checks the User-Agent header against a hardcoded list of search engine crawlers — Google, Yandex, Slurp, MSNBot, Rambler, ia_archiver — and returns a fake HTTP 404 page to any of them. This keeps the tool out of search engine indexes and away from researchers who discover shells via Google dorking. The evasion is simple but effective against the most common discovery vectors.

Vulnerabilities

The most immediate finding is that the default page load — no parameters, no authentication, no interaction — returns the contents of /etc/passwd. A simple GET request to the deployed URL is sufficient to enumerate every user account on the server. On shared hosting, that single file maps the entire tenant population of the box, turning one compromised account into a target list for the full server.

Self-incrimination is extensive: the author handle, scene affiliation, year of creation, and social media contact are embedded in the page title, footer, and directory artifacts created during operation.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_cpanel_cracker {
    meta:
        description = "cpanel_cracker config grabber (Donnazmi / AnonGhost)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/cpanel-cracker/"
        status      = "validated"

    strings:
        $donnazmi  = "Donnazmi" ascii
        $anonghost = "AnonGhost" ascii
        $ungku     = "ungku_nazmi" ascii
        $mkdir_don = "mkdir(\"Donnazmi/\")" ascii
        $named     = "/etc/named.conf" ascii
        $passwd    = "/etc/passwd" ascii
        $ua_google = "Googlebot" ascii
        $ua_yandex = "Yandex" ascii
        $ua_slurp  = "Slurp" ascii
        $ua_msn    = "MSNBot" ascii
        $symlink   = "symlink(" ascii

    condition:
        filesize < 80KB
        and (
            ($donnazmi or $anonghost or $ungku or $mkdir_don)
            or ($symlink and ($passwd or $named)
                and 2 of ($ua_*))
        )
}

MITRE ATT&CK

OHIIHO Threat Research.