#! /bin/bash
# Afrihost - quick find hacked users script-
# author: p
# date: 20210910

pdate=$(date +"%Y_%m_%d_%R")
afrins=( 'ns.otherdns.net' 'ns.otherdns.com' 'ns.dns2.co.za' 'ns.dns1.co.za' 'dns1.co.za' 'dns2.co.za' 'axxesslocal.co.za' )
poutfile=/root/.find_hacked_results

#=================
# based on inject patterns
{ cpl -dr | awk  '{print $NF}' | xargs -i echo  "ls -1  "{}/*.php" {}/.well-known/*.php"| bash  2>/dev/null  | while read drin ; do head -n15 "$drin"| egrep -qi  'urldecode\(\$OOOOOO|Oooo|Ooo|OO000O|x47\\x4c\\x4f|O0_O0OO0__|AED9D9|Ges6ses|fgyx1119|FIL8LI88LI|FI8LLII88L|73bb0|PKuON|@include\ \"\057home|45\%52\%54|_MqNNym1xo|O00OO0|O00|O_OO_O0_00|botbotbot1|class Dex|;if\(ndsw=|DUUC|CUUC|0U0|057ho|ORVX|057h\\157m'  && echo $drin ; done ; } |
while read pfile ; do
# echo -n "$pfile \n$(head $pfile)" ;
 CPUSER=`echo $pfile|awk -F "/" '{print $3}'`
 CPDOM=`egrep "$CPUSER" /etc/trueuserdomains| awk -F ":" '{print $1}'`
 CPUSPACEUSED=`/usr/sbin/repquota  -a -s  | grep "$CPUSER" | tail -n1 | awk '{print $3}'`
 for o in $(dig @8.8.8.8 ns +noall +answer $CPDOM | head -1 | awk '{print $5}' | sed 's/\.$//g') ; do
     if [[ "${afrins[@]}" =~ "$o" ]]
              then
                 DOMDNS="NSAFRI"
             else
                 DOMDNS="NSNOTAFRI"
     fi
 done
echo "$pdate $pfile" >> "$poutfile".files
echo "cpuser=$CPUSER::cpdom=$CPDOM::cpuserdisk=$CPUSPACEUSED::NS=$DOMDNS::$pdate" >> $poutfile
done
#=================

#=====
{ cpl -dr | awk  '{print $NF}' | xargs -i echo "ls -1  "{}/*.php"" | bash  2>/dev/null  | while read drin ; do for i in $(find $drin -name \*.php ) ; do echo "$i $(head -1 $i |awk '{ print length }' )" ; done | while read pphpfile pline1char ; do if (("$pline1char" >= 300 ))  ; then  echo "$pphpfile" |egrep -v 'google-analytics|script-loader-packages.php' ; fi  ; done 2>/dev/null  ; done ; } |
while read pfile ; do
# echo -n "$pfile \n$(head $pfile)" ;
 CPUSER=`echo $pfile|awk -F "/" '{print $3}'`
 CPDOM=`egrep "$CPUSER" /etc/trueuserdomains| awk -F ":" '{print $1}'`
 CPUSPACEUSED=`/usr/sbin/repquota  -a -s  | grep "$CPUSER" | tail -n1 | awk '{print $3}'`
 for o in $(dig @8.8.8.8 ns +noall +answer $CPDOM | head -1 | awk '{print $5}' | sed 's/\.$//g') ; do
     if [[ "${afrins[@]}" =~ "$o" ]]
              then
                 DOMDNS="NSAFRI"
             else
                 DOMDNS="NSNOTAFRI"
     fi
 done
echo "$pdate $pfile" >> "$poutfile".files
echo "cpuser=$CPUSER::cpdom=$CPDOM::cpuserdisk=$CPUSPACEUSED::NS=$DOMDNS::$pdate" >> $poutfile
done


#====

#=================
# based on smtpfox
cat /root/.smtpfox_attempt_found | grep `date +"%Y"-"%m-"`  | awk -F "::" '{print $NF}' | awk -F "/"  '{print $6}' | sort | uniq | 
while read psmtpfox ; do
 CPDOM=`egrep "$psmtpfox" /etc/trueuserdomains| awk -F ":" '{print $1}'`
 CPUSPACEUSED=`/usr/sbin/repquota  -a -s  | grep "$psmtpfox" | tail -n1 | awk '{print $3}'`
 for o in $(dig @8.8.8.8 ns +noall +answer $CPDOM | head -1 | awk '{print $5}' | sed 's/\.$//g') ; do
     if [[ "${afrins[@]}" =~ "$o" ]]
              then
                 DOMDNS="NSAFRI"
             else
                 DOMDNS="NSNOTAFRI"
     fi
 done
echo "$pdate $pfile"
echo "cpuser=$psmtpfox::cpdom=$CPDOM::cpuserdisk=$CPUSPACEUSED::NS=$DOMDNS::$pdate" >> $poutfile
done
#=================

#=================
# based on wpmalicious
cpl -dr | awk  '{print $NF}' | xargs -i echo "ls -1  "{}/*.php"" | bash 2>/dev/null  | grep -f /usr/local/afribin/configs/cpanel_known_malicious_wordpress_files | 
while read wpmalicious ; do
 CPDOM=`egrep "$wpmalicious" /etc/trueuserdomains| awk -F ":" '{print $1}'`
 CPUSPACEUSED=`/usr/sbin/repquota  -a -s  | grep "$wpmalicious" | tail -n1 | awk '{print $3}'`
 for o in $(dig @8.8.8.8 ns +noall +answer $CPDOM | head -1 | awk '{print $5}' | sed 's/\.$//g') ; do
     if [[ "${afrins[@]}" =~ "$o" ]]
              then
                 DOMDNS="NSAFRI"
             else
                 DOMDNS="NSNOTAFRI"
     fi
 done
echo "$pfile"
echo "cpuser=$wpmalicious::cpdom=$CPDOM::cpuserdisk=$CPUSPACEUSED::NS=$DOMDNS::$pdate" >> $poutfile
done
#=================


echo -e  "=== find hacked complete ==="
echo -e  "=== check hacked content found today: # grep  "$pdate"  "$poutfile".files ==="