danreb

#!/usr/bin/env bash
# Upgrade an Amazon Linux EC2 to PHP 7.3
#
# Last tested w/ PHP 7.2 AWS Linux version 2.8.5
#
# Must be ran as sudo:
#     sudo bash upgrade-php7.sh
#
# Can be added to ./.ebextensions/20_php.config like so:
#  container_commands:

danreb

#!/bin/bash

# Run this inside your cPanel account or just in public_html drupal web root

# Find the ico malware
find . -type f -name "favicon_*.ico"
find . -type f -name ".*.ico"

# Delete the malware, I did not delete favicon_*.ico as you need to double check it manually
find . -type f -name ".*.ico" -exec rm -f {} \;

danreb

grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

danreb

find /home/HOMEDIR/public_html \( -name "*.php" \) -type f -print0 | xargs -0 grep --binary-files=without-match -ir "base64_decode\s*("

danreb

========  ANATOMY OF DRUPAL 7 MODULE    ===============

1.) Required Files

     module_name.info     =  Tells Drupal the information about your module (http://drupal.org/node/542202 - writing module info file)
     module_name.module = Contains all hooks and functions related to module functionality

2.) Optional Files

      module_name.install   = Contains schema api hooks for creating and updating tables necessary for you module functionality

danreb

<?php
/**
 * Version 2.5
 * http://www.php-beginners.com/
 *
 * Legends:
 *		- long_text = this means that the file has long text without any space, a potential hacker code 
 *		- eval = eval is used mostly for hackers to hide their codes. example: eval(gzinflate(... or eval('DDsdf231Fee232ldk .....');
 * 		- c99madshell = a code found at the top of script like <?php $md5 = "....."; $wp_salt = "...";
 * 		- thumb - timthumb vulnerability

danreb

#!/bin/bash
find . -type f -name "database.inc" -exec sed -i 's/foreach ($data as $i => $value) {/foreach (array_values($data) as $i => $value) {/g' {} \;

danreb

<?php 

ob_start();

if (function_exists('shell_exec')) {
  
  // Adjust permission
  echo "Changing mode.....<br />";
  `chmod 777 sites/default`;
  `chmod 777 sites/default/settings.php`;

danreb

server {
		server_name test.domain.com;
                listen xxx.xxx.xxx.xxx;
		root /home/testuser/public_html;
		index index.html index.htm index.php;
		access_log /var/log/virtualmin/test.domain.com_access_log;
		error_log /var/log/virtualmin/test.domain.com_error_log;
		fastcgi_param GATEWAY_INTERFACE CGI/1.1;
		fastcgi_param SERVER_SOFTWARE nginx;
		fastcgi_param QUERY_STRING $query_string;

danreb

<?php

function THEMENAME_theme() {
  $items = array();
  // create custom user-login.tpl.php
  $items['user_login'] = array(
  'render element' => 'form',
  'path' => drupal_get_path('theme', 'THEMENAME') . '/template',
  'template' => 'user-login',
  'preprocess functions' => array(