|
+ ..:: MALWARE AUDIT ::.. + + |
+
+
+ ..:: INSTALLED SCRIPTS ::.. + + |
+
+
+ ..:: CLEANER ::.. + + |
+
+
+ ..:: MySQL ::.. + + |
+
|
+ ..:: FIND STUFF::.. + + |
+
+
+ ..:: SOP/MISC. ::.. + + |
+
+
+ ..:: USAGE Investigation ::.. + + |
+
$output"; */ + +/* let's scan and clean cryptoPHP */ +function cryptophp(){ + echo "Scanning for cryptoPHP in social.png files\n"; + system("find ../ -type f -iname \"social*.png\" -exec grep -E -o 'php.{0,80}' {} \; -print"); + + echo "\nScanning for cryptoPHP in all PNG files\n"; + system("find ../ -type f -iname '*.png' -print0 | xargs -0 file | grep \"PHP script\""); +} + +/* Execute The Malware Scanner */ +function scanme(){ +require_once("./scan.php"); +} + +/* Execute The PHP Cleaner */ +function cleanPHP(){ +require_once("./clean.php"); +} + +/* Execute the Perl Cleaners */ +function cleanPL(){ +system("./malware.pl"); +} + +/* Site Transfer Script */ +function transfer(){ +system("./transfer.pl"); + +} +/* EXIF scanner */ +function checkexif(){ +ini_set('exif.encode_unicode', 'UTF-8'); +define('IMAGEPATH', $GLOBALS["public_html"]); + +$directory = new RecursiveDirectoryIterator(IMAGEPATH); +$iterator = new RecursiveIteratorIterator($directory); +$matches = new RegexIterator($iterator, '/^.+\.(jpg|jpeg|png|tiff)$/i', RecursiveRegexIterator::GET_MATCH); +foreach($matches as $key => $match): + $exif = exif_read_data($match[0], 0, 'EXIF'); + echo '
', print_r($exif, true), ''; +endforeach; +} + +/* Insecure Plugins */ +function insecplug(){ + $plugins_list = array( + "complete-gallery-manager", + "wp-phpmyadmin", + "1-flash-gallery", + "category-list-portfolio-page", + "disclosure-policy-plugin", + "dp-thumbnail", + "ip-logger", + "is-human", + "jquery-slider-for-featured-content", + "kish-guest-posting", + "lisl-last-image-slider", + "really-easy-slider", + "rent-a-car", + "vk-gallery", + "wordpress-news-ticker-plugin", + "wp-marketplace", + "adminer", + "file-commander", + "portable-phpmyadmin", + "portable-phpmyadmin", + "toolspack", + "ToolsPack", + "revslider", + "research-plugin*" + ); + + foreach ($plugins_list as $plugin){ + + system($GLOBALS["findcmd"].' -type d -name '.$plugin.' -print'); + + } + +} + +/* Resource Hog Plugins */ +function reshog(){ + $plugin_list = array( + "broken-link-checker", + "myreviewplugin", + "linkman", + "fuzzy-seo-booster", + "wp-postviews", + "wordfence", + "tweet-blender", + "dynamic-related-posts", + "yet-another-related-posts-plugin", + "similar-posts", + "contextual-related-posts", + "yet-another-featured-posts-plugin", + "wponlinebackup", + "wpengine-snapshot", + "wpengine-migrate", + "wp-symposium-alerts", + "wp-slimstat", + "wp-missed-schedule", + "wordpress-gzip-compression", + "wp-cache", + "wp-database-optimizer", + "wp-db-backup", + "wp-dbmanager", + "wp-engine-snapshot", + "wp-file-cache", + "wp-mailinglist", + "async-google-analytics", + "backup-scheduler", + "backupwordpress", + "backwpup", + "duplicator", + "ewww-image-optimizer", + "ezpz-one-click-backup", + "google-xml-sitemaps-with-multisite-support", + "jr-referrer", + "missed-schedule", + "no-revisions", + "ozh-who-sees-ads", + "quick-cache", + "seo-alrp", + "si-captcha-for-wordpress", + "similar-posts", + "spyderspanker", + "spyderspanker_pro", + "super-post", + "superslider", + "text-passwords", + "the-codetree-backup", + ); + + foreach ($plugin_list as $plugins){ + + system($GLOBALS["findcmd"].' -type d -name '.$plugins.' -print'); + + } + +} + +/* EXIF cleaner */ +function cleanexif(){ +ini_set('exif.encode_unicode', 'UTF-8'); +define('IMAGEPATH', $GLOBALS["public_html"]); + +$directory = new RecursiveDirectoryIterator(IMAGEPATH); +$iterator = new RecursiveIteratorIterator($directory); +$matches = new RegexIterator($iterator, '/^.+\.(jpg|jpeg)$/i', RecursiveRegexIterator::GET_MATCH); + +foreach($matches as $key => $image): +echo '
', print_r($image, true),''; + try + { + $img = new Imagick($image[0]); + $img->stripImage(); + $img->writeImage($image[0]); + $img->clear(); + $img->destroy(); + + echo "Removed EXIF data from $image. \n"; + + } catch(Exception $e) { + echo 'Exception caught: ', $e->getMessage(), PHP_EOL; + } +endforeach; +} + +/* Get MySQL process list for a given user */ + +function processlist(){ +echo '