rm161/SODEW
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

jina verze

Browse Source
This commit is contained in:
rm161
2026-08-12 11:08:28 +02:00
parent afdc3e9013
commit 9ccebe4a59
109 changed files with 0 additions and 19938 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sodew-bash-main/libs/commands/malware.sh
-326
View File
@@ -1,326 +0,0 @@
function cmdMalwareUserList() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" ID,",
" CONVERT(user_login USING utf8mb4) COLLATE utf8mb4_unicode_ci AS user_login,",
" user_registered,",
" CONVERT('", t.table_name, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS table_name",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE user_login LIKE 'adm\\_%' OR user_login LIKE 'admin\\_%' OR user_login LIKE 'administrator\\_%' OR user_login LIKE 'backup\\_%'"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='user_login')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='ID')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='user_registered');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql"
printRow
}
function cmdMalwareOptionsList() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" option_id,",
" CONVERT(option_name USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_name,",
" CONVERT(autoload USING utf8mb4) COLLATE utf8mb4_unicode_ci AS autoload,",
" CONVERT('", t.table_name, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS table_name",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE option_name LIKE 'sc\\_%'"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_id')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_name')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='autoload');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql"
printRow
}
function cmdMalwareMuPluginList() {
local allowedFiles="
index.php
00-hosting-loader.php
load.php
hosting-wp-domain-rename.php
burst_rest_api_optimizer.php
elementor-safe-mode.php
mailoptin-customizer-optimizer.php
wgpwpp-cache.php
installatron_hide_status_test.php
"
run vhostsList error fileList "$vhostsPath" d || { printDanger "$error"; return 1; }
while read -r dir; do
local found=0
run itemList error fileList "$vhostsPath/$dir/www/wp-content/mu-plugins/" f || continue
while read -r item; do
if grep -qF '($i){static $a=null' "$vhostsPath/$dir/www/wp-content/mu-plugins/$item"; then
(( found++ )) || printSection "$dir"
printDotText "$item" "${fontRed}malware$fontReset"
elif ! listContains "$item" "$allowedFiles"; then
(( found++ )) || printSection "$dir"
printDotText "$item" "${fontYellow}warning$fontReset"
fi
done < <(awk 'NF' <<< "$itemList")
done < <(awk 'NF' <<< "$vhostsList")
printRow
}
function cmdMalwareFilesCheck() {
local target="$1"
local vhostList error
printRow
if [[ -z "$target" ]]; then
printDanger "Target not specified";
elif ! run vhostList error openlitespeedVhostList; then
printDanger "Cannot get vhost list: $error";
elif [[ "$target" == "all" ]]; then
local domain
for domain in $vhostList; do
mapfile -t diffArray < <(siteFilesCheck "$domain")
if [[ ${#diffArray[@]} -gt 0 ]]; then
printSection "$domain"
local line
for line in "${diffArray[@]}"; do
printText "$line"
done
fi
done
elif ! listContains "$target" "$vhostList"; then
printDanger "Unknown domain: $target";
else
mapfile -t diffArray < <(siteFilesCheck "$target")
if [[ ${#diffArray[@]} -gt 0 ]]; then
printDotText "$target" "$labelFail"
local line
for line in "${diffArray[@]}"; do
printText "$line"
done
else
printDotText "$target" "$labelDone"
fi
fi
printRow
}
function cmdMalwareOptionsTimestamps() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" option_id,",
" CONVERT(option_name USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_name,",
" CONVERT(option_value USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_value",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE option_name IN ('sc_last_fetch_ts','sc_last_rescan','sc_last_rpc')"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_id')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_name')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_value');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql" | sort -t$'\t' -k4 -rn
printRow
}
function cmdMalwareOptionsSuspiciousNames2() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" option_id,",
" CONVERT(option_name USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_name,",
" CONVERT(option_value USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_value",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE option_name LIKE 'sc\\_%' ESCAPE '\\\\'",
" OR option_name REGEXP '^[0-9a-f]{12}$'"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_id')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_name')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_value');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql" | sort -t$'\t' -k1,1 -k3,3
printRow
}
function cmdMalwareOptionsSuspiciousNames3() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" option_id,",
" CONVERT(option_name USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_name",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE option_name LIKE 'sc\\_%' ESCAPE '\\\\'",
" OR option_name REGEXP '^[0-9a-f]{12}$'"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_id')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_name')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_value');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql" | sort -t$'\t' -k1,1 -k3,3
printRow
}
function cmdMalwareOptionsSuspiciousNames() {
printRow
local output error databaseList
if ! run output error mariadbDatabaseListGet; then
printDotText "Databases" "$labelUnknown"
printDanger "$error"
return
fi
mapfile -t databaseList < <(awk 'NF' <<< "$output")
printDotText "Databases" "${#databaseList[@]}"
(( ${#databaseList[@]} > 0 )) || return
printRow
local inList
inList=$(printf "'%s'," "${databaseList[@]}")
inList="${inList%,}"
local sql
sql=$(cat << 'EOF'
SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(CONCAT(
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
" CONVERT('", t.table_name, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS table_name,",
" option_id,",
" CONVERT(option_name USING utf8mb4) COLLATE utf8mb4_unicode_ci AS option_name",
" FROM `", t.table_schema, "`.`", t.table_name, "`",
" WHERE option_name LIKE 'sc\\_%' ESCAPE '\\\\'",
" OR option_name REGEXP '^[0-9a-f]{12}$'"
) SEPARATOR ' UNION ALL ') INTO @sql
FROM information_schema.tables t
WHERE t.table_schema IN (__IN_LIST__)
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_id')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_name')
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='option_value');
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
EOF
)
sql="${sql/__IN_LIST__/$inList}"
mariadbMasterRootQuery "$sql" | sort -t$'\t' -k1,1 -k2,2 -k4,4
printRow
}