#bin/sh! echo '[*] Fixing file and folder permissions:'; # Directories find public_html/ -perm 0000 -follow -type d -print -exec chmod 755 {} \; >> $(whoami).txt find public_html/ -perm +og+w -follow -type d -print -exec chmod 755 {} \; >> $(whoami).txt # Files find public_html/ -perm 0000 -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt find public_html/ -perm 0400 -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt find public_html/ -perm 0440 -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt find public_html/ -perm 0444 -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt find public_html/ -perm 0555 -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt find public_html/ -perm +og+w -follow -type f -print -exec chmod 644 {} \; >> $(whoami).txt # Perl/CGI find public_html/ -perm +og+w -follow -type f -name "*.cgi" -print -exec chmod 755 {} \; >> $(whoami).txt find public_html/ -perm +og+w -follow -type f -name "*.pl" -print -exec chmod 755 {} \; >> $(whoami).txt echo echo '[*] Removing data garbage like error logs:'; echo >> $(whoami).txt find public_html/ -type f -name "error_log" -exec rm -rfv {} \; >> $(whoami).txt echo '[*] Running the malware cleaner:'; perl public_html/LP-MSH-Scanner/malwaresh.pl $(whoami) >> $(whoami).txt echo >> $(whoami).txt echo '[*] Running the Python scanner :'; python public_html/LP-MSH-Scanner/scan.py --minscore=10 /home/$(whoami) | grep filename >> $(whoami).txt echo >> $(whoami).txt echo '[*] Running the CMS Version Scanner:'; php -d memory_limit=512M public_html/LP-MSH-Scanner/cms-vss.php $(whoami) >> $(whoami).txt echo >> $(whoami).txt echo '[*] Running the PHP Scanner:'; cd /home/$(whoami)/public_html/LP-MSH-Scanner && php -d memory_limit=512M scan.php >> /home/$(whoami)/$(whoami).txt echo >> $(whoami).txt # SOP # Fix .htaccess # find /home/$(whoami)/public_html/ -type f -name ".htaccess -print -exec cat $htaccess >> {} \; # Fix php.ini / .user.ini # find /home/$(whoami)/public_html/ -type f -name ".user.ini" -print -exec cat $php-ini >> {} \; # find /home/$(whoami)/public_html/ -type f -name "php.ini" -print -exec cat $php-ini >> {} \; # Fix /tmp # find /home/$(whoami)/public_html -type d -name "uploads" -print -exec cat $tmp >> {} \; # Full cPanel backup # DIRSIZE = "du -shb /home/$(whoami) | cut -f1"; # if [[ $DIRSIZE < 5368709120 ]]; then # do_backup # fi # # checking for unrelated echo '[*] Suspicious files in /tmp?'; ls -al /tmp/ | grep $(whoami) | grep -v sess_ echo echo '[*] Processes running:'; ps -eo pid,user,cmd | grep $(whoami) echo '[*] Checking for Unrelated Data'; echo >> $(whoami).txt echo '[*] Directories with more than 1GB size:'; du -h ./ | grep '[0-9]G\>' >> $(whoami).txt echo >> $(whoami).txt echo '[*] Files with more than 10M size:'; find ./ -size +10000k -exec du -sh {} \; >> $(whoami).txt echo "Results available in: /home/$(whoami)/$(whoami).txt" | mail -s 'MSH Scan of `whoami`' mshteam@lunarpages.com echo '[*] Job done... removing the scanner'; rm -rf /home/$(whoami)/public_html/LP-MSH-Scanner