Edit: /opt/dedrads/extras/seohackscanner (6565B)
#!/usr/bin/perl
#
# Made by Brandon Florin
$date = `date +'%Y%m%d.%H%M%S'`;
chomp ($date);
# Configurable settings:
$searchpattern = 'base64_encode.*eval.*curl_init.*base64_decode.*curl_exec';
$numbersphppattern = '\/[0-9]*\.php$';
$allphppattern = '\.php$';
$logdir = '/root/seohack';
$logfile = $logdir."/seohacks.txt.".$date;
# DO NOT MODIFY BELOW THIS POINT!
use Getopt::Std; # needed to take options from the command line
$opt_h = undef;
$opt_p = undef;
$opt_u = undef;
$opt_f = undef;
$opt_s = undef;
$usage = "usage: $0 -p [clean|identify] -u [username|full]" .
"\n".
"Where:\n".
" $0 -p identify -u full - This will identify all seohacks across the entire server\n".
" $0 -p identify -u inmoti5 - This will scan the inmoti5 user for SEO hacks without cleaning them\n".
" $0 -p clean -u full - This will identify/clean the entire server for seohacks\n".
" $0 -p clean -u inmoti5 - This will identify/clean a specific user for seohacks\n".
" Any output can be found in $logfile\n".
"\n";
getopts ('p:u:f:s:h');
if ( (defined($opt_s)) ) {
# User-defined skip list
$skip = $opt_s;
}
if ( (defined($opt_f)) ) {
# Force clean on files greater than 1 line
$force = $opt_f;
}
if ( (defined($opt_h)) ) {
# print help
print $usage;
exit;
}
if ( (defined($opt_p)) ) {
# purpose: clean or identify
$purpose = $opt_p;
} else {
# not defined, print usage
print $usage;
exit;
}
if ( (defined($opt_u)) ) {
# user: full or specific username to clean
$iuser = $opt_u;
} else {
# not defined, print usage
print $usage;
exit;
}
if (-e $logdir) {
# do nothing, $logdir is created
} else {
`mkdir $logdir`;
}
############ MAIN #######################
if (defined($skip)) { &read_skip_list; }
print "Building file list :: $iuser\n";
&build_file_list($iuser);
if ($purpose =~ /identify/) { exit; }
print "Cleaning $iuser\n";
&clean($iuser);
chomp ($count);
print "Cleanup has completed, cleaned ".scalar(@users)." users and ".$count." SEO hacks total\n";
exit;
############# END MAIN ##############
sub clean {
$iuser = shift;
open(IN,"<$logfile");
foreach $line (
) {
chomp ($line);
if ($line !~ /./) { next; }
($homepath, $user, $file) = $line =~ /^\/(hom.*?)\/(.*?)\/(.*?)$/i;
if (inArray($skip, @skiplist)) { last; }
$filetodelete = "/".$homepath."/".$user."/".$file;
$linecount = `cat $filetodelete | wc -l`;
if ($linecount == "1") {
print "linecount = 1 :: $filetodelete\n";
`/bin/rm -f $filetodelete`;
} elsif (($linecount > 1 && defined($force))) {
print "linecount > 1 :: $filetodelete\n";
#Check: should we include beginning/end php tags, also, what about variants?
#check examples
#//;' -i $filetodelete`;
} else {
`echo $filetodelete >> $logdir/check_these.txt`;
print "$filetodelete not touched, check $logdir/check_these.txt and then add -f flag to force changes\n";
}
#
if (inArray($user,@users)) {
# Do nothing if the user is already in the array
} else {
push(@users,$user);
}
print "Deleted $filetodelete\n";
}
print "Scanning for .htaccess hacks...\n";
foreach $usr (@users) {
chomp ($usr);
print "Scanning $usr...\n";
$status = `find /home/$usr/public_html/ -name ".htaccess" | sed -e "s/^/\\"/\;" | sed -e "s/\$/\\"/\;" | xargs grep MultiViews > /$logdir/htaccess_cleanup.txt`;
# Set some vars to read in the whole file at once instead of line by line
open (IN1,"<$logdir/htaccess_cleanup.txt");
foreach () {
chomp ($_);
$_ =~ s/.htaccess:Options -MultiViews/.htaccess/i;
undef($/);
open (TMP,"<$_");
$in = ;
$/ = "\n";
close (TMP);
$in =~ s/Options -MultiViews\nErrorDocument 404 \/\/.*?[0-9]+\.php//ig;
open(OUT,">$_");
print OUT "$in";
close (OUT);
}
}
}
sub inArray {
my ($item, @arr) = @_;
foreach (@arr) {
if ($item eq $_) { return 1; }
}
return 0;
}
sub build_file_list {
my ($iuser) = @_;
if ($iuser !~ /./) { print $usage; exit; }
if ($iuser =~ /full/) {
$status = `locate -r '/home/.*/public_html.*$numbersphppattern' | sed -e "s/^/\"/;" | sed -e "s/$/\"/;" | grep -v "\/404.php" | grep -iv pear | xargs egrep '$searchpattern' | cut -d: -f1 >> $logfile`;
} else {
$status = `locate -r '/home/$iuser/public_html.*$numbersphppattern' | sed -e 's/^/\"/\;' | sed -e 's/\$/\"/\;' | grep -v '\/404.php' | grep -iv pear | xargs egrep '$searchpattern' | cut -d: -f1 >> $logfile`;
}
$count = `cat $logfile | wc -l`;
chomp ($count);
print "Found ".$count." SEO hacks total\n";
print "A log of this scan can be found in $logfile\n";
}
sub read_skip_list {
open(SKIP,"<$skip");
foreach () {
chomp ($_);
push(@skiplist,$_);
}
}