NO NO NO 175649 /home/verseaumee/zenit/administrator/components/com_hikashop/classes/product.php #1789489248 NO NO NO 25379 /home/verseaumee/zenit/administrator/components/com_hikashop/controllers/product.php #1789489248 NO NO NO 9790 /home/verseaumee/zenit/administrator/components/com_hikashop/controllers/plugins.php #1789489248 NO NO NO 1887 /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/tables/item.php #1789489248 NO NO NO 3729 /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/models/item.php #1789489248 NO NO NO 2334 /home/verseaumee/zenit/administrator/components/com_spsimpleportfolio/controllers/item.php #1789489248 NO NO NO 511 /home/verseaumee/zenit/administrator/components/com_plugins/helpers/plugins.php #1789489248 NO NO NO 249 /home/verseaumee/josholurinfr/wp-admin/network/plugins.php #1789489248 NO NO NO 30744 /home/verseaumee/josholurinfr/wp-admin/plugins.php #1789489248 NO YES NO 5203 /home/verseaumee/josholurinfr/wp-includes/Text/Diff/Engine/shell.php #1789489248 NO NO NO 2241 /home/verseaumee/josholurinfr/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php #1789489248 NO NO NO 209 /home/verseaumee/josholurinfr/wp-content/plugins/jetpack/_inc/lib/plugins.php #1789489248 NO NO NO 5244 /home/verseaumee/josholurinfr/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php #1789489248 NO NO NO 2016 /home/verseaumee/josholurinfr/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489248 NO NO NO 302 /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489248 NO NO NO 1687 /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489248 NO NO NO 559 /home/verseaumee/josholurinfr/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489248 NO NO NO 30744 /home/verseaumee/lauvia/wp-admin/plugins.php #1789489248 NO NO NO 249 /home/verseaumee/lauvia/wp-admin/network/plugins.php #1789489248 NO NO NO 910 /home/verseaumee/lauvia/wp-content/plugins/the-events-calendar/src/views/v2/components/subscribe-links/item.php #1789489248 NO NO NO 1382 /home/verseaumee/lauvia/wp-content/plugins/the-events-calendar/src/views/v2/components/events-bar/views/list/item.php #1789489248 NO NO NO 2016 /home/verseaumee/lauvia/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489248 NO NO NO 302 /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489248 NO NO NO 559 /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489248 NO NO NO 1687 /home/verseaumee/lauvia/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489248 NO NO NO 20022 /home/verseaumee/lauvia/wp-content/plugins/trx_updater/core/update/plugins.php #1789489249 NO NO NO 2664 /home/verseaumee/lauvia/wp-content/plugins/instagram-feed/templates/item.php #1789489249 NO YES NO 5203 /home/verseaumee/lauvia/wp-includes/Text/Diff/Engine/shell.php #1789489249 NO NO NO 558 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489249 NO NO NO 1686 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489249 NO NO NO 300 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489249 NO NO NO 313 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php #1789489249 NO NO NO 1028 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php #1789489249 NO NO NO 2383 /home/verseaumee/middletvnew/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php #1789489249 NO NO NO 2019 /home/verseaumee/middletvnew/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489249 NO YES NO 5203 /home/verseaumee/middletvnew/wp-includes/Text/Diff/Engine/shell.php #1789489249 NO NO NO 30724 /home/verseaumee/middletvnew/wp-admin/plugins.php #1789489249 NO NO NO 249 /home/verseaumee/middletvnew/wp-admin/network/plugins.php #1789489249 NO NO NO 30724 /home/verseaumee/blueversion/wp-admin/plugins.php #1789489249 NO NO NO 249 /home/verseaumee/blueversion/wp-admin/network/plugins.php #1789489249 NO NO NO 1863 /home/verseaumee/blueversion/wp-content/themes/motors/admin/templates/plugins.php #1789489249 NO NO NO 1565 /home/verseaumee/blueversion/wp-content/plugins/cyberdom-core/inc/shortcodes/item-showcase/variations/list/templates/parts/item.php #1789489249 NO NO NO 2952 /home/verseaumee/blueversion/wp-content/plugins/instagram-feed/templates/item.php #1789489249 NO NO NO 3680 /home/verseaumee/blueversion/wp-content/plugins/feeds-for-youtube/templates/item.php #1789489249 NO NO NO 5244 /home/verseaumee/blueversion/wp-content/plugins/elementorpro3171n/modules/woocommerce/documents/product.php #1789489249 NO NO NO 16937 /home/verseaumee/blueversion/wp-content/plugins/give/includes/admin/plugins.php #1789489249 NO NO NO 492 /home/verseaumee/blueversion/wp-content/plugins/envato-market/inc/admin/view/partials/plugins.php #1789489249 NO NO NO 2327 /home/verseaumee/blueversion/wp-content/plugins/custom-twitter-feeds/templates/item.php #1789489249 NO NO NO 2016 /home/verseaumee/blueversion/wp-content/plugins/elementorx/modules/system-info/reporters/plugins.php #1789489249 NO NO NO 302 /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/revert/plugins.php #1789489249 NO NO NO 559 /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/export/plugins.php #1789489249 NO NO NO 1687 /home/verseaumee/blueversion/wp-content/plugins/elementorx/app/modules/import-export/runners/import/plugins.php #1789489249 NO NO NO 302 /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489249 NO NO NO 1687 /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489249 NO NO NO 559 /home/verseaumee/blueversion/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489250 NO NO NO 2016 /home/verseaumee/blueversion/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489250 NO NO NO 911 /home/verseaumee/blueversion/wp-content/plugins/wpforms/templates/builder/payment/recurring/item.php #1789489250 NO NO NO 1119 /home/verseaumee/blueversion/wp-content/plugins/wpforms/includes/functions/plugins.php #1789489250 NO NO NO 5244 /home/verseaumee/blueversion/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php #1789489250 NO NO NO 435 /home/verseaumee/blueversion/wp-content/plugins/complianz-gdpr/settings/config/fields/wizard/plugins.php #1789489250 NO NO NO 1199 /home/verseaumee/blueversion/wp-content/plugins/wc-donation-platform/includes/wc-templates/single-product/add-to-cart/product.php #1789489250 NO NO NO 1843 /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/admin/inc/admin-pages/sub-pages/widgets/templates/item.php #1789489250 NO NO NO 850 /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/business-hours/variations/standard/templates/item.php #1789489250 NO NO NO 1112 /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/pricing-list/variations/standard/templates/item.php #1789489250 NO NO NO 1162 /home/verseaumee/blueversion/wp-content/plugins/qi-addons-for-elementor/inc/shortcodes/pricing-list/variations/image-before/templates/item.php #1789489250 NO YES NO 5203 /home/verseaumee/blueversion/wp-includes/Text/Diff/Engine/shell.php #1789489250 NO NO NO 30744 /home/verseaumee/maze/wp-admin/plugins.php #1789489250 NO NO NO 249 /home/verseaumee/maze/wp-admin/network/plugins.php #1789489250 NO YES NO 5203 /home/verseaumee/maze/wp-includes/Text/Diff/Engine/shell.php #1789489250 NO NO NO 209 /home/verseaumee/maze/wp-content/plugins/jetpack/_inc/lib/plugins.php #1789489250 NO NO NO 2241 /home/verseaumee/maze/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php #1789489250 NO NO NO 2019 /home/verseaumee/maze/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489250 NO NO NO 313 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php #1789489250 NO NO NO 2383 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php #1789489250 NO NO NO 1028 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php #1789489250 NO NO NO 300 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489250 NO NO NO 558 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489250 NO NO NO 1686 /home/verseaumee/maze/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489250 YES YES NO 1758 /home/verseaumee/genieprevention/product.php #1789489250 NO NO NO 25579 /home/verseaumee/genieprevention/templates/bizone/html/com_k2/templates/default/item.php #1789489250 YES NO NO 54169 /home/verseaumee/genieprevention/witmmm.php #1789489251 NO NO NO 1248 /home/verseaumee/genieprevention/layouts/joomla/html/batch/item.php #1789489251 NO NO NO 307 /home/verseaumee/genieprevention/components/com_k2/views/item/tmpl/item.php #1789489251 NO NO NO 11065 /home/verseaumee/genieprevention/components/com_k2/controllers/item.php #1789489251 NO NO NO 28882 /home/verseaumee/genieprevention/components/com_k2/templates/default/item.php #1789489251 NO NO NO 68200 /home/verseaumee/genieprevention/components/com_k2/models/item.php #1789489251 NO NO NO 4324 /home/verseaumee/genieprevention/libraries/joomla/form/fields/plugins.php #1789489251 NO NO NO 2483 /home/verseaumee/genieprevention/libraries/f0f/form/field/plugins.php #1789489251 NO NO NO 2483 /home/verseaumee/genieprevention/libraries/fof/form/field/plugins.php #1789489251 YES YES NO 1758 /home/verseaumee/genieprevention/item.php #1789489251 YES YES NO 1758 /home/verseaumee/genieprevention/click.php #1789489251 NO NO NO 3424 /home/verseaumee/genieprevention/administrator/components/com_plugins/helpers/plugins.php #1789489251 NO NO NO 611 /home/verseaumee/genieprevention/administrator/components/com_plugins/plugins.php #1789489251 NO NO NO 883 /home/verseaumee/genieprevention/administrator/components/com_plugins/controllers/plugins.php #1789489251 NO NO NO 7989 /home/verseaumee/genieprevention/administrator/components/com_plugins/models/plugins.php #1789489251 NO NO NO 1196 /home/verseaumee/genieprevention/administrator/components/com_privacy/helpers/export/item.php #1789489251 NO NO NO 3350 /home/verseaumee/genieprevention/administrator/components/com_jce/helpers/plugins.php #1789489251 NO NO NO 15868 /home/verseaumee/genieprevention/administrator/components/com_jce/models/plugins.php #1789489251 YES NO NO 16316 /home/verseaumee/genieprevention/administrator/components/com_menus/controllers/item.php #1789489251 NO NO NO 43673 /home/verseaumee/genieprevention/administrator/components/com_menus/models/item.php #1789489251 NO NO NO 47482 /home/verseaumee/genieprevention/administrator/components/com_k2/models/item.php #1789489251 NO NO NO 2728 /home/verseaumee/genieprevention/administrator/components/com_k2/controllers/item.php #1789489251 NO NO NO 3256 /home/verseaumee/genieprevention/administrator/components/com_k2/elements/item.php #1789489251 YES YES NO 1823 /home/verseaumee/genieprevention/plugins.php #1789489251 NO NO NO 30744 /home/verseaumee/blueversionx/wp-admin/plugins.php #1789489251 NO NO NO 249 /home/verseaumee/blueversionx/wp-admin/network/plugins.php #1789489251 NO YES NO 5203 /home/verseaumee/blueversionx/wp-includes/Text/Diff/Engine/shell.php #1789489251 NO NO NO 1382 /home/verseaumee/blueversionx/wp-content/plugins/the-events-calendar/src/views/v2/components/events-bar/views/list/item.php #1789489252 NO NO NO 910 /home/verseaumee/blueversionx/wp-content/plugins/the-events-calendar/src/views/v2/components/subscribe-links/item.php #1789489252 NO NO NO 2664 /home/verseaumee/blueversionx/wp-content/plugins/instagram-feed/templates/item.php #1789489252 NO NO NO 20022 /home/verseaumee/blueversionx/wp-content/plugins/trx_updater/core/update/plugins.php #1789489252 NO NO NO 2016 /home/verseaumee/blueversionx/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489252 NO NO NO 1687 /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489252 NO NO NO 559 /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489252 NO NO NO 302 /home/verseaumee/blueversionx/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489252 NO NO NO 598 /home/verseaumee/ptitsanes/administrator/components/com_plugins/plugins.php #1789489252 NO NO NO 870 /home/verseaumee/ptitsanes/administrator/components/com_plugins/controllers/plugins.php #1789489252 NO NO NO 3410 /home/verseaumee/ptitsanes/administrator/components/com_plugins/helpers/plugins.php #1789489252 NO NO NO 7976 /home/verseaumee/ptitsanes/administrator/components/com_plugins/models/plugins.php #1789489252 NO NO NO 1183 /home/verseaumee/ptitsanes/administrator/components/com_privacy/helpers/export/item.php #1789489252 YES NO NO 16303 /home/verseaumee/ptitsanes/administrator/components/com_menus/controllers/item.php #1789489252 NO NO NO 43814 /home/verseaumee/ptitsanes/administrator/components/com_menus/models/item.php #1789489252 NO NO NO 1231 /home/verseaumee/ptitsanes/layouts/joomla/html/batch/item.php #1789489252 NO NO NO 2483 /home/verseaumee/ptitsanes/libraries/fof/form/field/plugins.php #1789489252 NO NO NO 4311 /home/verseaumee/ptitsanes/libraries/joomla/form/fields/plugins.php #1789489252 NO YES NO 5203 /home/verseaumee/geniouskin/wp-includes/Text/Diff/Engine/shell.php #1789489252 NO NO NO 30724 /home/verseaumee/geniouskin/wp-admin/plugins.php #1789489252 NO NO NO 249 /home/verseaumee/geniouskin/wp-admin/network/plugins.php #1789489252 NO NO NO 558 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489252 NO NO NO 1686 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489252 NO NO NO 300 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489252 NO NO NO 313 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php #1789489252 NO NO NO 2383 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php #1789489252 NO NO NO 1028 /home/verseaumee/geniouskin/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php #1789489252 NO NO NO 2019 /home/verseaumee/geniouskin/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489252 NO NO NO 249 /home/verseaumee/colorkeysstudio/wp-admin/network/plugins.php #1789489252 NO NO NO 30744 /home/verseaumee/colorkeysstudio/wp-admin/plugins.php #1789489253 NO YES NO 5203 /home/verseaumee/colorkeysstudio/wp-includes/Text/Diff/Engine/shell.php #1789489253 NO NO NO 5244 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor-pro/modules/woocommerce/documents/product.php #1789489253 NO NO NO 2019 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489253 NO NO NO 1686 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489253 NO NO NO 558 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489253 NO NO NO 300 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489253 NO NO NO 1028 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php #1789489253 NO NO NO 2383 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php #1789489253 NO NO NO 313 /home/verseaumee/colorkeysstudio/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php #1789489253 NO NO NO 2241 /home/verseaumee/colorkeysstudio/wp-content/plugins/jetpack/modules/tiled-gallery/tiled-gallery/templates/partials/item.php #1789489253 NO NO NO 209 /home/verseaumee/colorkeysstudio/wp-content/plugins/jetpack/_inc/lib/plugins.php #1789489253 NO NO NO 249 /home/verseaumee/empowernetkenyajuly2026/wp-admin/network/plugins.php #1789489253 NO NO NO 30744 /home/verseaumee/empowernetkenyajuly2026/wp-admin/plugins.php #1789489253 NO NO NO 17010 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/give/includes/admin/plugins.php #1789489253 NO NO NO 559 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489253 NO NO NO 1687 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489253 NO NO NO 302 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489253 NO NO NO 2016 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489253 NO NO NO 1119 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/wpforms/includes/functions/plugins.php #1789489253 NO NO NO 911 /home/verseaumee/empowernetkenyajuly2026/wp-content/plugins/wpforms/templates/builder/payment/recurring/item.php #1789489253 NO YES NO 5203 /home/verseaumee/empowernetkenyajuly2026/wp-includes/Text/Diff/Engine/shell.php #1789489253 NO NO NO 17374 /home/verseaumee/TF89388/wp-content/plugins/newsletter/includes/mailer.php #1789489253 NO YES NO 5210 /home/verseaumee/TF89388/wp-includes/Text/Diff/Engine/shell.php #1789489253 NO NO NO 30744 /home/verseaumee/middletvnew26/wp-admin/plugins.php #1789489253 NO NO NO 249 /home/verseaumee/middletvnew26/wp-admin/network/plugins.php #1789489253 NO NO NO 2019 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/modules/system-info/reporters/plugins.php #1789489253 NO NO NO 1028 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/export/plugins.php #1789489253 NO NO NO 2383 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/import/plugins.php #1789489253 NO NO NO 313 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export-customization/runners/revert/plugins.php #1789489254 NO NO NO 558 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/export/plugins.php #1789489254 NO NO NO 1686 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/import/plugins.php #1789489254 NO NO NO 300 /home/verseaumee/middletvnew26/wp-content/plugins/elementor/app/modules/import-export/runners/revert/plugins.php #1789489283 NO YES NO 5203 /home/verseaumee/middletvnew26/wp-includes/Text/Diff/Engine/shell.php #1789489285 while IFS= read -r f; do [ -f "$f" ] || continue obf="NO"; execflag="NO"; upload="NO" grep -aqE 'base64_decode|gzinflate|str_rot13|eval[[:space:]]*\(' "$f" && obf="YES"; grep -aqE 'shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|proc_open|popen|curl_exec' "$f" && execflag="YES"; grep -aqE 'move_uploaded_file|file_put_contents|chmod[[:space:]]*\(' "$f" && upload="YES" echo "--------------------------------"; echo "$f"; echo "SIZE: $(wc -c < "$f")"; echo "SHA256: $(sha256sum "$f" | cut -d' ' -f1)"; echo "OBF=$obf EXEC=$execflag UPLOAD=$upload" done < /home/verseaumee/security-scan/reports/root-shell-candidates.txt #1789489317 sha256sum /home/verseaumee/zenit/product.php #1789489460 mkdir -p /home/verseaumee/security-scan/reports #1789489461 mkdir -p /home/verseaumee/security-scan/quarantine #1789489467 rm -f /home/verseaumee/zenit/product.php #1789489626 rm -f /home/verseaumee/zenit/product.php #1789489628 chmod -R u+rwX /home/verseaumee/zenit 2>/dev/null #1789489659 rm -rf -- /home/verseaumee/zenit #1789489680 if [ -e /home/verseaumee/zenit ]; then echo "ZENIT STILL EXISTS"; else echo "ZENIT PERMANENTLY DELETED"; fi #1789489740 chmod -R u+rwX /home/verseaumee/www 2>/dev/null #1789489759 if [ -e /home/verseaumee/www ]; then echo "WWW STILL EXISTS"; else echo "WWW PERMANENTLY DELETED"; fi #1789489781 if [ -e /home/verseaumee/www ]; then echo "WWW STILL EXISTS"; else echo "WWW PERMANENTLY DELETED"; fi #1789489826 rm -rf -- /home/verseaumee/www 2> /home/verseaumee/www-delete-errors.txt #1789489846 if [ -e /home/verseaumee/www ]; then echo "WWW STILL EXISTS"; echo "Remaining items:"; find /home/verseaumee/www -maxdepth 2 -print 2>/dev/null | head -50; echo "Delete errors:"; head -50 /home/verseaumee/www-delete-errors.txt; else echo "WWW PERMANENTLY DELETED"; fi #1789489914 find /home/verseaumee/www -type d -exec chmod u+rwx {} + 2>/dev/null #1789489915 find /home/verseaumee/www -type f -exec chmod u+rw {} + 2>/dev/null #1789489951 rm -rf -- /home/verseaumee/www #1789489963 test ! -e /home/verseaumee/www && echo "WWW PERMANENTLY DELETED" || echo "WWW STILL EXISTS" #1789490016 chmod u+w /home/verseaumee/genieprevention #1789490031 tar -czf /home/verseaumee/security-scan/quarantine/genie-root-malware.tar.gz /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php #1789490052 rm -f /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php #1789490059 for f in /home/verseaumee/genieprevention/product.php /home/verseaumee/genieprevention/witmmm.php /home/verseaumee/genieprevention/item.php /home/verseaumee/genieprevention/click.php /home/verseaumee/genieprevention/plugins.php; do [ -e "$f" ] && echo "STILL EXISTS: $f"; done #1789490085 grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*\([[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null > /home/verseaumee/security-scan/reports/fresh-malware-scan.txt #1789490243 wc -l /home/verseaumee/security-scan/reports/fresh-malware-scan.txt #1789490297 cat /home/verseaumee/security-scan/reports/fresh-malware-scan.txt #1789490301 f="$(cat /home/verseaumee/security-scan/reports/fresh-malware-scan.txt)" #1789490301 echo "$f" #1789490301 sha256sum "$f" #1789490301 wc -c "$f" #1789490307 grep -aoEi 'base64_decode|gzinflate|str_rot13|eval|assert|system|shell_exec|passthru|exec|proc_open|popen|curl_exec|file_put_contents|move_uploaded_file|chmod|php_uname|FilesMan|WSO' "$f" | sort -u #1789490336 echo "$f" #1789490341 sha256sum "$f" #1789490347 wc -c "$f" #1789490382 tar -czf /home/verseaumee/security-scan/quarantine/last-malware-index.tar.gz /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php #1789490387 rm -f /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php #1789490393 chmod u+w /home/verseaumee/genieprevention/libraries/joomla/github/package/issues #1789490400 rm -f /home/verseaumee/genieprevention/libraries/joomla/github/package/issues/index.php #1789490407 grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*\([[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null > /home/verseaumee/security-scan/reports/fresh-malware-scan.txt #1789490522 wc -l /home/verseaumee/security-scan/reports/fresh-malware-scan.txt #1789490570 grep -RIn --exclude-dir=security-scan --include=".user.ini" --include="php.ini" --include=".htaccess" -E 'auto_prepend_file|auto_append_file|base64_decode|gzinflate|shell_exec|passthru|eval\(|php_value[[:space:]]+auto_' /home/verseaumee 2>/dev/null #1789490679 crontab -l 2>/dev/null #1789490687 ls -la /home/verseaumee/.ssh 2>/dev/null #1789490693 cat /home/verseaumee/.ssh/authorized_keys 2>/dev/null #1789490699 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f \( -name "*.php" -o -name ".htaccess" -o -name ".user.ini" \) -mtime -7 -printf "%TY-%Tm-%Td %TH:%TM %p\n" 2>/dev/null | sort -r | head -100 #1789490793 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f \( -name 'worksec.php' -o -name 'wp-editor.php' -o -name 'wp-theme.php' -o -name 'lock360.php' -o -name 'wp-content-css.php' \) -print 2>/dev/null #1789490883 ls -la /home/verseaumee/.ssh 2>/dev/null #1789490883 cat /home/verseaumee/.ssh/authorized_keys 2>/dev/null #1789490890 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f \( -name 'worksec.php' -o -name 'wp-editor.php' -o -name 'wp-theme.php' -o -name 'lock360.php' -o -name 'wp-content-css.php' \) -print 2>/dev/null #1789490933 grep -RIl --exclude-dir=security-scan --include="*.php" -E 'FilesMan|WSO[[:space:]]|c99shell|r57shell|b374k|IndoXploit|ALFA[[:space:]]*SHELL|eval[[:space:]]*\([[:space:]]*base64_decode|eval[[:space:]]*\([[:space:]]*gzinflate|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' /home/verseaumee 2>/dev/null | wc -l #1789491996 cd /home/verseaumee/security-scan/tools #1789491996 php wp-cli.phar --info #1789492052 mkdir -p /home/verseaumee/security-scan/tools #1789492059 cd /home/verseaumee/security-scan/tools #1789492065 curl -L -o wp-cli.phar https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar #1789492076 ls -lh wp-cli.phar #1789492084 php wp-cli.phar --info #1789492115 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -name 'wp-config.php' -printf '%h\n' 2>/dev/null | sort -u > /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789492375 wc -l /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789492384 cat /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789492432 WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar #1789492432 REPORT=/home/verseaumee/security-scan/reports/wordpress-core-checks.txt #1789492432 : > "$REPORT" #1789492432 while IFS= read -r site; do echo "===== $site =====" | tee -a "$REPORT" php "$WPCLI" --path="$site" core verify-checksums --include-root 2>&1 | tee -a "$REPORT" echo "" | tee -a "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789492492 grep -Ei 'warning|error|doesn.t verify|should not exist|checksum|failed' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt #1789492501 grep -Eic 'warning|error|doesn.t verify|should not exist|checksum|failed' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt #1789492553 grep -Ei 'Warning:|Error:|doesn.t verify|should not exist' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt | grep -v 'Success:' > /home/verseaumee/security-scan/reports/core-anomalies.txt #1789492581 wc -l /home/verseaumee/security-scan/reports/core-anomalies.txt #1789492586 head -80 /home/verseaumee/security-scan/reports/core-anomalies.txt #1789492601 awk ' /^===== / {site=$0} /Warning:|Error:|doesn.t verify|should not exist/ { if ($0 !~ /Success:/) { print site print " " $0 } } ' /home/verseaumee/security-scan/reports/wordpress-core-checks.txt > /home/verseaumee/security-scan/reports/core-anomalies-by-site.txt #1789492610 head -100 /home/verseaumee/security-scan/reports/core-anomalies-by-site.txt #1789509557 ps -u "$(whoami)" -f | grep '[w]p-cli.phar' #1789509566 cat > /home/verseaumee/security-scan/repair-wordpress-core.sh <<'EOF' #!/bin/sh WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar LIST=/home/verseaumee/security-scan/reports/wordpress-roots.txt while IFS= read -r site; do echo "========================================" echo "SITE: $site" VER=$(grep -m1 "\$wp_version =" "$site/wp-includes/version.php" 2>/dev/null \ | sed "s/.*'\([^']*\)'.*/\1/") echo "VERSION: $VER" if [ -n "$VER" ]; then php "$WPCLI" core download \ --path="$site" \ --version="$VER" \ --force \ --skip-content else echo "SKIPPED - VERSION NOT DETECTED" fi done < "$LIST" echo "CORE REPAIR FINISHED" EOF #1789509580 chmod +x /home/verseaumee/security-scan/repair-wordpress-core.sh #1789509585 nohup /home/verseaumee/security-scan/repair-wordpress-core.sh > /home/verseaumee/security-scan/reports/core-repair.log 2>&1 & #1789509606 tail -30 /home/verseaumee/security-scan/reports/core-repair.log #1789509654 tail -30 /home/verseaumee/security-scan/reports/core-repair.log #1789509661 grep "CORE REPAIR FINISHED" /home/verseaumee/security-scan/reports/core-repair.log #1789509668 php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content #1789509678 php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force \ #1789509755 chmod u+rwx /home/verseaumee/blueversion #1789509765 test -w /home/verseaumee/blueversion && echo "WRITABLE" || echo "NOT WRITABLE" #1789509772 php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content #1789509801 find /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes -type d -exec chmod u+rwx {} + 2>/dev/null #1789509810 find /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes -type f -exec chmod u+rw {} + 2>/dev/null #1789509827 tail -40 /home/verseaumee/security-scan/reports/core-repair.log #1789509875 grep -nE 'SITE:|Error:|SKIPPED|Permission denied|Permission non accordée' /home/verseaumee/security-scan/reports/core-repair.log #1789509884 WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar #1789509884 while IFS= read -r site; do OUT=$(php "$WPCLI" --path="$site" core verify-checksums --include-root 2>&1) BAD=$(printf '%s\n' "$OUT" | grep -Ec "doesn't verify against checksum|doesn't exist"); EXTRA=$(printf '%s\n' "$OUT" | grep -c "File should not exist:") echo "$site"; echo " MODIFIED/MISSING: $BAD"; echo " EXTRA FILES: $EXTRA"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789510082 WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar #1789510082 php "$WPCLI" --path=/home/verseaumee/colorkeysstudio core verify-checksums --include-root 2>&1 | grep -E "doesn't verify against checksum|doesn't exist" #1789510163 WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar #1789510164 REPORT=/home/verseaumee/security-scan/reports/plugin-checksums.txt #1789510164 : > "$REPORT" #1789510164 while IFS= read -r site; do echo "===== $site =====" | tee -a "$REPORT" php "$WPCLI" --path="$site" plugin verify-checksums --all --strict --skip-themes 2>&1 | tee -a "$REPORT" echo "" | tee -a "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789510174 grep -Ei 'Warning:|Error:|doesn.t verify|should not exist|checksum|Could not retrieve|Couldn.t fetch' /home/verseaumee/security-scan/reports/plugin-checksums.txt > /home/verseaumee/security-scan/reports/plugin-anomalies.txt #1789510182 wc -l /home/verseaumee/security-scan/reports/plugin-anomalies.txt #1789510190 head -100 /home/verseaumee/security-scan/reports/plugin-anomalies.txt #1789510252 wc -l /home/verseaumee/security-scan/reports/plugin-checksums.txt #1789510259 REPORT=/home/verseaumee/security-scan/reports/wp-content-malware-scan.txt #1789510259 : > "$REPORT" #1789510259 while IFS= read -r site; do echo "===== $site =====" >> "$REPORT" find "$site/wp-content/plugins" "$site/wp-content/themes" "$site/wp-content/mu-plugins" "$site/wp-content/uploads" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -print0 2>/dev/null | xargs -0 -r grep -IlE 'eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate|str_rot13)|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|system[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|move_uploaded_file[[:space:]]*\([[:space:]]*\$_FILES' >> "$REPORT" done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789510330 grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | wc -l #1789510336 grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | wc -l #1789510346 grep '^/home/' /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt | head -100 #1789510353 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -path '*/wp-content/uploads/*' \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -print 2>/dev/null > /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789510390 wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789510400 REPORT=/home/verseaumee/security-scan/reports/wp-root-malware.txt #1789510401 : > "$REPORT" #1789510401 while IFS= read -r site; do find "$site" -maxdepth 1 -type f \( -iname '*.php' -o -iname '*.phtml' \) -print0 2>/dev/null | xargs -0 -r grep -IlE 'eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate|str_rot13)|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|system[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|move_uploaded_file[[:space:]]*\([[:space:]]*\$_FILES' >> "$REPORT"; done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789510413 wc -l /home/verseaumee/security-scan/reports/wp-root-malware.txt #1789510451 cat /home/verseaumee/security-scan/reports/wp-root-malware.txt #1789510458 while IFS= read -r f; do echo "===== $f ====="; wc -c "$f"; sha256sum "$f"; done < /home/verseaumee/security-scan/reports/wp-root-malware.txt #1789510467 wc -l /home/verseaumee/security-scan/reports/wp-content-malware-scan.txt #1789510474 wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789511392 ls -lh /home/verseaumee/security-scan/reports/php-in-uploads.txt /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt /home/verseaumee/security-scan/reports/wp-root-malware.txt 2>/dev/null #1789511399 awk -F'\t' '$2=="YES" || $3=="YES" {n++} END {print "SUSPICIOUS UPLOAD PHP:", n+0}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt #1789511404 echo "NON-INDEX PHP:" #1789511404 grep -Ev '/index\.php$' /home/verseaumee/security-scan/reports/php-in-uploads.txt | wc -l #1789511414 awk -F'\t' '$2=="YES" || $3=="YES" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt | head -100 #1789511448 wc -l /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789511455 REPORT=/home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt #1789511455 : > "$REPORT" #1789511455 while IFS= read -r f; do [ -f "$f" ] || continue SIZE=$(wc -c < "$f"); HASH=$(sha256sum "$f" | cut -d' ' -f1) grep -aqE 'base64_decode|gzinflate|str_rot13|eval[[:space:]]*\(' "$f" && OBF=YES || OBF=NO grep -aqE 'shell_exec|passthru|system[[:space:]]*\(|exec[[:space:]]*\(|proc_open|popen|curl_exec|file_put_contents|move_uploaded_file' "$f" && DANGER=YES || DANGER=NO grep -aqE '\$_(POST|GET|REQUEST|FILES|COOKIE)' "$f" && INPUT=YES || INPUT=NO printf "%s\t%s\t%s\t%s\t%s\t%s\n" "$SIZE" "$OBF" "$DANGER" "$INPUT" "$HASH" "$f" >> "$REPORT" done < /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789511464 awk -F'\t' '$2=="YES" || $3=="YES" {n++} END {print "SUSPICIOUS:", n+0}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt #1789511469 awk -F'\t' '$2=="YES" || $3=="YES" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt | head -100 #1789511534 awk -F'\t' '$2=="YES" || $3=="YES" {print $6}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt > /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511541 wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511547 Q="/home/verseaumee/security-scan/quarantine/uploads-php-$(date +%Y%m%d-%H%M%S)" #1789511547 mkdir -p "$Q" #1789511547 while IFS= read -r f; do [ -f "$f" ] || continue REL="${f#/home/verseaumee/}"; DEST="$Q/$REL" mkdir -p "$(dirname "$DEST")"; chmod u+w "$(dirname "$f")" 2>/dev/null if mv -- "$f" "$DEST"; then echo "QUARANTINED: $f"; else echo "FAILED: $f"; fi; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511558 while IFS= read -r f; do [ -e "$f" ] && echo "STILL EXISTS: $f"; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511579 wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511589 wc -l /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511620 Q="/home/verseaumee/security-scan/quarantine/uploads-php-$(date +%Y%m%d-%H%M%S)" #1789511620 mkdir -p "$Q" #1789511620 while IFS= read -r f; do [ -f "$f" ] || continue REL="${f#/home/verseaumee/}"; DEST="$Q/$REL" mkdir -p "$(dirname "$DEST")"; chmod u+w "$(dirname "$f")" 2>/dev/null if mv -- "$f" "$DEST"; then echo "QUARANTINED: $f"; else echo "FAILED: $f"; fi; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511627 while IFS= read -r f; do [ -e "$f" ] && echo "STILL EXISTS: $f"; done < /home/verseaumee/security-scan/reports/suspicious-upload-php.txt #1789511634 awk -F'\t' '$2=="NO" && $3=="NO" {print}' /home/verseaumee/security-scan/reports/uploads-php-diagnostics.txt > /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt #1789511640 wc -l /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt #1789511645 cut -f5 /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt | sort | uniq -c | sort -nr | head -20 #1789511654 grep -Ev '/index\.php$' /home/verseaumee/security-scan/reports/uploads-php-unflagged.txt | head -80 #1789511666 cat /home/verseaumee/security-scan/reports/wp-root-malware.txt #1789511728 f=/home/verseaumee/colorkeysstudio/wp-content/uploads/hp2.php #1789511728 echo "FILE: $f" #1789511728 wc -c "$f" #1789511728 sha256sum "$f" #1789511728 file "$f" #1789511728 echo "LONGEST LINE:" #1789511728 awk '{ if(length>m)m=length } END {print m}' "$f" #1789511728 echo "SUSPICIOUS TOKENS:" #1789511728 grep -aoEi 'base64|gzinflate|gzdecode|str_rot13|strrev|hex2bin|pack|chr|eval|assert|system|shell_exec|passthru|exec|proc_open|popen|curl|wget|move_uploaded_file|file_put_contents|unlink|chmod|php_uname|\$_GET|\$_POST|\$_REQUEST|\$_COOKIE|\$_FILES|call_user_func|create_function|openssl_decrypt' "$f" | sort -u #1789511783 find /home/verseaumee -path /home/verseaumee/security-scan -prune -o -type f -size 33983c -exec sha256sum {} + 2>/dev/null | grep '^c1eda8add9fe6cf5e1be92c89d30bdadb169fe2476f12e937c0cace4c3f0ea1d' #1789511893 chmod -R u+rwX /home/verseaumee/blueversion #1789511931 php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content #1789512002 php /home/verseaumee/security-scan/tools/wp-cli.phar --path=/home/verseaumee/blueversion core verify-checksums --include-root #1789512096 mkdir -p /home/verseaumee/security-scan/quarantine/blueversion-root #1789512103 for f in system.php about.php admin.php gtaavijg.php .well-known/q1.php; do [ -f "/home/verseaumee/blueversion/$f" ] && mv "/home/verseaumee/blueversion/$f" /home/verseaumee/security-scan/quarantine/blueversion-root/; done #1789512109 chmod -R u+rwX /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes #1789512117 rm -rf /home/verseaumee/blueversion/wp-admin /home/verseaumee/blueversion/wp-includes #1789512125 php /home/verseaumee/security-scan/tools/wp-cli.phar core download --path=/home/verseaumee/blueversion --version=6.8.3 --force --skip-content #1789512134 php /home/verseaumee/security-scan/tools/wp-cli.phar --path=/home/verseaumee/blueversion core verify-checksums --include-root 2>&1 | grep "File should not exist:" #1789512207 f=/home/verseaumee/blueversion/config.php #1789512207 echo "SIZE:" #1789512207 wc -c "$f" #1789512207 echo "HASH:" #1789512207 sha256sum "$f" #1789512207 echo "TYPE:" #1789512207 file "$f" #1789512208 echo "SUSPICIOUS FUNCTIONS:" #1789512208 grep -aoEi 'base64_decode|gzinflate|eval|assert|system|shell_exec|passthru|exec|curl_exec|file_put_contents|move_uploaded_file|php_uname|preg_replace|str_rot13|proc_open|popen' "$f" | sort -u #1789512235 stat /home/verseaumee/blueversion/config.php #1789512244 WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar #1789512244 REPORT=/home/verseaumee/security-scan/reports/plugin-checks.txt #1789512245 : > "$REPORT" #1789512245 while IFS= read -r site; do echo "========================================" | tee -a "$REPORT"; echo "SITE: $site" | tee -a "$REPORT" php "$WPCLI" --path="$site" plugin verify-checksums --all --strict 2>&1 | tee -a "$REPORT" done < /home/verseaumee/security-scan/reports/wordpress-roots.txt #1789512260 grep -Ei 'Warning:|Error:|does not match|doesn.t verify|checksum|not found' /home/verseaumee/security-scan/reports/plugin-checks.txt | head -100 #1789512366 cat > /home/verseaumee/security-scan/full-wp-audit.sh <<'EOF' #!/bin/sh WPCLI=/home/verseaumee/security-scan/tools/wp-cli.phar LIST=/home/verseaumee/security-scan/reports/wordpress-roots.txt R=/home/verseaumee/security-scan/reports : > "$R/core-final.txt" : > "$R/root-extras.txt" : > "$R/plugins-final.txt" : > "$R/themes-list.txt" : > "$R/php-in-uploads.txt" : > "$R/content-high-confidence.txt" : > "$R/disguised-php.txt" while IFS= read -r site; do echo "========================================" echo "SCANNING: $site" echo "===== $site =====" >> "$R/core-final.txt" php "$WPCLI" \ --path="$site" \ --skip-plugins \ --skip-themes \ core verify-checksums \ >> "$R/core-final.txt" 2>&1 echo "===== $site =====" >> "$R/root-extras.txt" php "$WPCLI" \ --path="$site" \ --skip-plugins \ --skip-themes \ core verify-checksums \ --include-root \ >> "$R/root-extras.txt" 2>&1 echo "===== $site =====" >> "$R/plugins-final.txt" php "$WPCLI" \ --path="$site" \ --skip-plugins \ --skip-themes \ plugin verify-checksums \ --all \ --strict \ >> "$R/plugins-final.txt" 2>&1 echo "===== $site =====" >> "$R/themes-list.txt" php "$WPCLI" \ --path="$site" \ --skip-plugins \ --skip-themes \ theme list \ --fields=name,status,version,update \ --format=table \ >> "$R/themes-list.txt" 2>&1 if [ -d "$site/wp-content/uploads" ]; then find "$site/wp-content/uploads" \ -type f \ \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php5' -o -iname '*.php7' \) \ -print 2>/dev/null \ >> "$R/php-in-uploads.txt" fi grep -RIl \ --include='*.php' \ -E 'eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate)|assert[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|shell_exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|passthru[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|system[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)|exec[[:space:]]*\([[:space:]]*\$_(GET|POST|REQUEST|COOKIE)' \ "$site/wp-content/plugins" \ "$site/wp-content/themes" \ 2>/dev/null \ >> "$R/content-high-confidence.txt" grep -RIl \ --include='*.jpg' \ --include='*.jpeg' \ --include='*.png' \ --include='*.gif' \ --include='*.ico' \ --include='*.txt' \ '/dev/null \ >> "$R/disguised-php.txt" done < "$LIST" echo "FULL WORDPRESS AUDIT FINISHED" EOF #1789512375 chmod +x /home/verseaumee/security-scan/full-wp-audit.sh #1789512380 nohup /home/verseaumee/security-scan/full-wp-audit.sh > /home/verseaumee/security-scan/reports/full-wp-audit.log 2>&1 & #1789512394 tail -30 /home/verseaumee/security-scan/reports/full-wp-audit.log #1789512404 echo "CORE PROBLEMS:" #1789512404 grep -Ec "doesn't verify|doesn't exist|Error:" /home/verseaumee/security-scan/reports/core-final.txt #1789512404 echo "ROOT EXTRAS:" #1789512404 grep -c "File should not exist:" /home/verseaumee/security-scan/reports/root-extras.txt #1789512404 echo "PLUGIN WARNINGS:" #1789512404 grep -Ec "Warning:|Error:" /home/verseaumee/security-scan/reports/plugins-final.txt #1789512404 echo "PHP IN UPLOADS:" #1789512404 wc -l < /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789512404 echo "HIGH-CONFIDENCE PLUGIN/THEME HITS:" #1789512404 wc -l < /home/verseaumee/security-scan/reports/content-high-confidence.txt #1789512404 echo "PHP HIDDEN IN NON-PHP FILES:" #1789512405 wc -l < /home/verseaumee/security-scan/reports/disguised-php.txt #1789512437 echo "CORE PROBLEMS:" #1789512437 grep -Ec "doesn't verify|doesn't exist|Error:" /home/verseaumee/security-scan/reports/core-final.txt #1789512437 echo "ROOT EXTRAS:" #1789512437 grep -c "File should not exist:" /home/verseaumee/security-scan/reports/root-extras.txt #1789512437 echo "PLUGIN WARNINGS:" #1789512437 grep -Ec "Warning:|Error:" /home/verseaumee/security-scan/reports/plugins-final.txt #1789512437 echo "PHP IN UPLOADS:" #1789512437 wc -l < /home/verseaumee/security-scan/reports/php-in-uploads.txt #1789512437 echo "HIGH-CONFIDENCE PLUGIN/THEME HITS:" #1789512437 wc -l < /home/verseaumee/security-scan/reports/content-high-confidence.txt