---
title: Tip: on any Control Web Panel server, run the three cwpdoor checks today, and if one hits, treat the box as rooted | ctxsec
url: https://ctxsec.com/items/tip-cwp-servers-check-cwpsrv-for-cwpdoor-then-rebuild
description: "cwpdoor hides its file timestamps, so ls and stat look normal; check the running socket and the binary's strings instead. Because installing it took root, swapping cwpsrv back is not enough."
status: "operational guidance (QiAnXin XLab, Nov 5)"
published: 2026-11-07
---

> cwpdoor hides its file timestamps, so ls and stat look normal; check the running socket and the binary's strings instead. Because installing it took root, swapping cwpsrv back is not enough.

[← Tips & Guides](/tips) · [markdown](/items/tip-cwp-servers-check-cwpsrv-for-cwpdoor-then-rebuild.md)

operational guidance (QiAnXin XLab, Nov 5)

2026-11-07

### Tip: on any Control Web Panel server, run the three cwpdoor checks today, and if one hits, treat the box as rooted

- `ss -axp | grep integrity` should return nothing; `strings /usr/local/cwpsrv/bin/cwpsrv | grep -c X-Ngx-Integrity` should be 0.
- Hit: restore from `/usr/local/cwpsrv/bin/cwpsrv.prev-*` if present (the installer may delete it), upgrade CWP, re-check, change every panel and root credential, and look for Ebury and other persistence. Rebuilding is safer.
- Block `136.0.141[.]71` and keep the CWP panel ports off the internet (VPN or IP allowlist).

Sources: [QiAnXin XLab: CWPdoor (Nov 5)](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/)