Scan for changed and suspucious files on WordPress sites.

dirdiff.sh

# Set this to the directory where the script is installed.
# Make sure the script is saving the files in a sane place
# when running as a cron job.
ROOT=.
#Directory to scan
DIR=/home/*/web/*/public_html/

if [ ! -f ${ROOT}/dirdiff.lst ];
then
        touch ${ROOT}/dirdiff.lst
fi

mv ${ROOT}/dirdiff.lst ${ROOT}/dirdiff.lst.old
find ${DIR} -type f -printf "%p %s %t\n" > ${ROOT}/dirdiff.lst
diff -u0 ${ROOT}/dirdiff.lst.old ${ROOT}/dirdiff.lst > ${ROOT}/dirdiff.txt

# Remember to add a valid email address.
mutt -s "Web dir diff -  $(hostname) - $(date)" someone@somewhere < ${ROOT}/dirdiff.txt

find ${DIR} -type f -print0 | xargs -0 stat --format '%Y :%y %n' | sort -nr | cut -d: -f2- | head -n 2500 > ${ROOT}/newest.lst
mutt -s "Newest modified files on  $(hostname) - $(date)" someone@somewhere < ${ROOT}/newest.lst

#Stuff seen often, files ending with numbers
wget -q  https://gist.github.com/deadbok/235be04d68bf999accf156e4965ea1c9/raw/excl-susp.lst -O ${ROOT}/excl-susp.lst
find ${DIR} -regex '.*[0-9]+\.php' $(while read excl; do echo "! -iname ${excl} "; done < ${ROOT}/excl-susp.lst) > ${ROOT}/suspicious.lst
#Darkshell something...
find ${DIR} -iname wp-functions.php >> ${ROOT}/suspicious.lst
#Also seens often, infects the other files in the root as well.
find ${DIR} -maxdepth 1 -name post.php >> ${ROOT}/suspicious.lst
mutt -s "Suspicious files on $(hostname) - $(date)" someone@somewhere < ${ROOT}/suspicious.lst

excl-susp.lst

module.tag.lyrics3.php
view.step0.php
view.step1.php
view.step2.php
view.step3.php
class-wp-filesystem-ssh2.php
404.php
wp-contact-form-7.php
ajax.step1.php
ajax.step2.php
Crammd5.php
Oauth2.php
Pop3.php
OAuth2.php
P12.php
autoload_psr4.php
module.tag.id3v1.php
getid3.php
module.tag.id3v2.php
module.audio.ac3.php
module.audio.mp3.php
IPv6.php
class-pop3.php
feed-rss2.php
embed-404.php
woocommerce-update-1.5.php
woocommerce-update-1.4.php
woocommerce-update-2.1.php
woocommerce-update-2.0.9.php
woocommerce-update-2.0.php
woocommerce-update-2.4.php
woocommerce-update-2.2.php
woocommerce-update-2.5.php
woocommerce-update-2.4.1.php
woocommerce-update-2.3.php
class.km.autoupdate.v3.php
class.km.autoupdate.themes.v3.php
class.km.autoupdate.plugins.v3.php
subscribe2.php
acf-wp_wysiwyg-v5.php
acf-wp_wysiwyg-v4.php
acf-wp_wysiwyg-v3.php
ClassLoader52.php
autoload_real_52.php
Google_OAuth2.php
autoload_52.php
wp-cache-phase1.php
wp-cache-phase2.php
wppg-photo-gallery-template-1.php
wppg-photo-gallery-template-3.php
wppg-photo-gallery-template-2.php
yui-php-cssmin-2.4.8-4.php
wp-cache-phase2.ph
jsmin-1.1.1.php
class-bwp-framework-v3.php
class-bwp-option-page-v3.php
template-home-1.php
template-home-4.php
template-home-2.php
template-home-3.php
Crypt/RC2.php
RC4.php
ASN1.php
X509.php
SSH2.php
SSH1.php