90 lines
3.1 KiB
Bash
90 lines
3.1 KiB
Bash
function cmdMalwareUserList() {
|
|
printRow
|
|
|
|
local output error databaseList
|
|
if ! run output error mariadbDatabaseListGet; then
|
|
printDot 60 "Databases" "$labelUnknown"
|
|
printDanger "$error"
|
|
return
|
|
fi
|
|
mapfile -t databaseList < <(awk 'NF' <<< "$output")
|
|
printDot 60 "Databases" "${#databaseList[@]}"
|
|
(( ${#databaseList[@]} > 0 )) || return
|
|
printRow
|
|
|
|
local inList
|
|
inList=$(printf "'%s'," "${databaseList[@]}")
|
|
inList="${inList%,}"
|
|
|
|
local sql
|
|
sql=$(cat << 'EOF'
|
|
SET SESSION group_concat_max_len = 1000000;
|
|
SELECT GROUP_CONCAT(CONCAT(
|
|
"SELECT CONVERT('", t.table_schema, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS db_name,",
|
|
" ID,",
|
|
" CONVERT(user_login USING utf8mb4) COLLATE utf8mb4_unicode_ci AS user_login,",
|
|
" user_registered,",
|
|
" CONVERT('", t.table_name, "' USING utf8mb4) COLLATE utf8mb4_unicode_ci AS table_name",
|
|
" FROM `", t.table_schema, "`.`", t.table_name, "`",
|
|
" WHERE user_login LIKE 'adm\\_%' OR user_login LIKE 'admin\\_%' OR user_login LIKE 'administrator\\_%' OR user_login LIKE 'backup\\_%'"
|
|
) SEPARATOR ' UNION ALL ') INTO @sql
|
|
FROM information_schema.tables t
|
|
WHERE t.table_schema IN (__IN_LIST__)
|
|
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='user_login')
|
|
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='ID')
|
|
AND EXISTS (SELECT 1 FROM information_schema.columns c WHERE c.table_schema=t.table_schema AND c.table_name=t.table_name AND c.column_name='user_registered');
|
|
PREPARE stmt FROM @sql;
|
|
EXECUTE stmt;
|
|
DEALLOCATE PREPARE stmt;
|
|
EOF
|
|
)
|
|
sql="${sql/__IN_LIST__/$inList}"
|
|
|
|
mariadbMasterRootQuery "$sql"
|
|
|
|
printRow
|
|
}
|
|
|
|
function cmdMalwareMuPluginList() {
|
|
local allowedFiles="
|
|
index.php
|
|
00-hosting-loader.php
|
|
load.php
|
|
hosting-wp-domain-rename.php
|
|
burst_rest_api_optimizer.php
|
|
elementor-safe-mode.php
|
|
mailoptin-customizer-optimizer.php
|
|
wgpwpp-cache.php
|
|
installatron_hide_status_test.php
|
|
"
|
|
|
|
run vhostsList error fileList "$vhostsPath" d || { printDanger "$error"; return 1; }
|
|
while read -r dir; do
|
|
local found=0
|
|
run itemList error fileList "$vhostsPath/$dir/www/wp-content/mu-plugins/" f || continue
|
|
while read -r item; do
|
|
if grep -qF '($i){static $a=null' "$vhostsPath/$dir/www/wp-content/mu-plugins/$item"; then
|
|
(( found++ )) || printSection "$dir"
|
|
printDot 60 "$item" "${fontRed}malware$fontReset"
|
|
elif ! listContains "$item" "$allowedFiles"; then
|
|
(( found++ )) || printSection "$dir"
|
|
printDot 60 "$item" "${fontYellow}warning$fontReset"
|
|
fi
|
|
done < <(awk 'NF' <<< "$itemList")
|
|
done < <(awk 'NF' <<< "$vhostsList")
|
|
|
|
printRow
|
|
}
|
|
|
|
function cmdMalwareFilesCheck() {
|
|
local target="${1:-all}"
|
|
|
|
if [[ "$target" == "all" ]]; then
|
|
siteAllFilesCheck || return 1
|
|
else
|
|
# printSection "$domain"
|
|
siteFilesCheck "$target"
|
|
fi
|
|
printRow
|
|
}
|