✘✘ GRAYBYTE WORDPRESS FILE MANAGER ✘✘

​🇳​​🇦​​🇲​​🇪♯➤ server.blackpussy.asia ​🇻​♯➤ 5.14.0-611.20.1.el9_7.x86_64 #1 SMP 🇾​♯➤ 2026

𝗛𝗢𝗠𝗘 𝗜𝗗 ♯➤ 163.245.207.76 ♯➤ 𝗔𝗗𝗠𝗜𝗡 𝗜𝗗 216.73.216.243
𝗢𝗣𝗧𝗜𝗢𝗡𝗦 ♯ CRL ♯➤ 𝗢𝗞 ┃ WGT ♯➤ 𝗢𝗞 ┃ SDO ♯➤ 𝗢𝗞 ┃ PKEX ♯➤ 𝗢𝗙𝗙
𝗗𝗘𝗔𝗖𝗧𝗜𝗩𝗔𝗧𝗘𝗗 ♯➤ mail,mb_send_mail
𝗖𝗨𝗥𝗥𝗘𝗡𝗧 𝗙𝗜𝗟𝗘 : /usr/local/sbin/__pycache__//wpmm-watchdogcpython-39.pyc
a

�1�j��@s�ddlZddlZddlZddlZddlZddlZddlZddlZddlZddl	m	Z	ddl
mZed�ZedZ
edZedZedZed	�Zed
�ZdZdZd
ZdZdZdZdZdZdZdZed�ZdZdZdYdd�Z dd�Z!dd�Z"dd�Z#d d!�Z$d"d#�Z%d$d%�Z&dZd'd(�Z'd)d*�Z(d+d,�Z)d-d.�Z*d/d0�Z+d1d2�Z,d3d4�Z-d5d6�Z.d7d8�Z/d9d:�Z0d;d<�Z1d=d>�Z2d?d@�Z3dAdB�Z4dCdD�Z5dEdF�Z6dGdH�Z7dIdJ�Z8dKdL�Z9dMdN�Z:dOdP�Z;d[dRdS�Z<dTdU�Z=dVdW�Z>e?dXk�r�e>�dS)\�N)�datetime)�Pathz/var/lib/wpmm-watchdogzstatus.jsonz
state.jsonz
counters.jsonz
security.jsonz/var/log/wpmm-watchdog.logz/etc/wpmm-watchdog.jsonz
172.96.184.87i �2�����i��z/var/lock/wpmm-autoblock.lock)�oi)"r�����5�P�n��i�iKiiii�i�iiii i"i#i&i'i+i/i0i�i^i�i� i'iB'i�m�<cCs0tj|dtjtjd|d�}|j|j|j��fS)NT)�shell�stdout�stderrZuniversal_newlines�timeout)�
subprocess�run�PIPE�
returncoderr�strip)�commandr�proc�r �/usr/local/sbin/wpmm-watchdogr%s
�rcKsht����jdd�|d�|�}tjddd��(}|�tj|dd�d	�Wd�n1sZ0YdS)
N�seconds�Ztimespec)�time�event�a�utf-8��encodingF)�ensure_ascii�
)	r�now�
astimezone�	isoformat�LOG_FILE�open�write�json�dumps)r%�detail�record�handler r r!�log-sr7cCs0zt�|jdd��WSty*|YS0dS)Nr'r()r2�loads�	read_text�	Exception)�path�defaultr r r!�	load_json3sr=cCs:|�|jd�}|jtj|ddd�dd�t�||�dS)Nz.tmpF��r*�indentr'r()Zwith_suffix�suffix�
write_textr2r3�os�replace)r;�dataZ	temporaryr r r!�	save_json:srFcCs6td|��dd�\}}|r&|��dS|dkr2dSdS)Nzsystemctl is-active �
�rr�active�unknown)r�
splitlines)�name�code�outputr r r!�service_status@srOc	Cs�i}td�����D],}|�dd�\}}t|����d�||<q|�dd�d|�dd�d|�dd�d|�d	d�d|�dd�|�d	d�dd
�S)Nz
/proc/meminfo�:�rZMemTotal�ZMemAvailableZ	SwapTotalZSwapFree)Ztotal_mb�available_mb�
swap_total_mbZswap_free_mb�swap_used_mb)rr9rK�split�intr�get)�values�line�key�rawr r r!�memory_metricsEs�r]cCs�t|pd�}|�d�rPd|vrP|�d�}|d|��dd�d||dd�fSd|vr||�dd�\}}|�dd�d|fS|dfS)	N��[z]:rQ�%rr>rP)�str�
startswith�rfindrV�rsplit)�value�end�address�portr r r!�split_socket_endpointSs
(rir c	Csjt�}t|pg�t|pg�D]F}z.t|�}d|kr@dkrNnn
|�|�WqtybYq0q|S)NrQi��)�set�listrW�addr:)rY�defaults�resultreZnumberr r r!�integer_set^sroc	CsPt|�dg�t�}|�t|�dd�p&d��tddd�\}}g}|dk�r,|��D]�}|��}t|�dkrlqR|d�	�}t
|d	�\}}	zt|	�}
Wnty�YqRYn0zt�
|�}|d
vp�|j}Wnty�|dv}Yn0|s�qRd|v�r|�dd
�d
dd�nd}
|�|||
|
|
|vd��qRdd�|D�}||t|�t|�d�S)NZallowed_public_ports�ssh_portrzss -H -lntuprrHr��)�0.0.0.0�::)rsrt�*zusers:(rQrr^)�protocolrgrh�process�allowedcSsg|]}|ds|�qS)rxr )�.0�itemr r r!�
<listcomp>��z$listener_metrics.<locals>.<listcomp>)Zpublic�
unexpected�unexpected_countZ
allowed_ports)rorX�DEFAULT_ALLOWED_PUBLIC_PORTSrlrWrrKrV�len�lowerrir:�	ipaddress�
ip_address�	is_global�append�sorted)�configrxrMrN�	listenersrZ�partsrvrgZraw_portrh�ipZpublic_bindrwr}r r r!�listener_metricsjs4


&r�cCs`z<t�t|��}|jdkr4ttjt|�ddd��nt|�WStyZt|pRd�YS0dS)Nrrz/16F��strictu未知)r�r�ra�version�
ip_networkr:)rergr r r!�class_b_network�s
.r�c
Cs,i}|��D�]~\}}t|�}|�||ddigid��}tt|t�rP|�dd�n|�}|d|7<|dd7<|d�||d��z$tt	j
tt	�|��dd	d
��}Wnty�t|�}Yn0|d�||ddigd��}|d|7<|dd7<|d�||d��t|t�r|�d
i���D]V\}	}
|d
�|	d�t|
�pTd�|d
|	<|d
�|	d�t|
�pzd�|d
|	<�q4qt
|��dd�d�}|D]�}t
|ddd�d�dd�|d<t
|�d���dd�d�}|D]&}t
|ddd�d�dd�|d<�q�||d<t|�|d<�q�|S)Nr)�network�count�source_count�states�ips�_subnetsr�r�rQr��r�r�z/24Fr�r�)r�r�r�r�r�r�cSs|d|dfS�Nr�r�r �rer r r!�<lambda>�r|z#aggregate_class_b.<locals>.<lambda>�r[cSs|d|dfS�Nr�r�r r�r r r!r��r|�cSs|d|dfSr�r r�r r r!r��r|cSs|d|dfSr�r r�r r r!r��r|�subnets�subnet_count)�itemsr��
setdefaultrW�
isinstance�dictrXr�rar�r�r�r:r�rY�popr�)
Zsource_items�networksr�r4r�rzr�Zsubnet_name�subnet�stateZstate_count�rowsr�r r r!�aggregate_class_b�s:$
&, $r�c

sg}|D]>}z"t�|�}|jdkr,|�|�WqtyDYqYq0q|D]�}g}d}|�dg�D]r}z,tj|�dd�dd���fdd	�|D�}	Wnty�g}	Yn0t|	�|d
<|	|d<|�|	�|	sd|d7}qdt	t
|��|d<t|�|d
<||d<|dk|d
<qL|S)Nrrrr�r�r^Tr�csg|]}|�vrt|��qSr )ra)ryrg�r�r r!r{�r|z.annotate_network_whitelist.<locals>.<listcomp>�whitelistedZ
protected_ipsrQZhas_protected_subnetsZblockable_subnet_count)r�r�r�r�r:rXr��bool�extendr�rj)
�network_rows�	whitelistZvalid_whitelistrergr�Z
protected_allZ	blockableZsubnet_item�	protectedr r�r!�annotate_network_whitelist�s6




r�c	Cs�t|�dg��}t�d�r�td�td�fD]\}zD|jdd���D].}|�dd�d	����}|r@|�	|d	�q@Wq*t
y�Yq*0q*g}|D]J}z.tjt
|���d
d�}|jdkr�|�	|�Wq�t
y�Yq�Yq�0q�|S)
N�connection_whitelist_ips�csf�/etc/csf/csf.allowz/etc/csf/csf.ignorerD��errors�#rQrFr�rr)rkrX�shutil�whichrr9rKrVrr�r:r�r�rar�)r�rYr;r\�tokenr�rer�r r r!�configured_protected_networks�s&

r�c	Cs�g}ztd�jdd���}Wnty2|YS0|D]d}|�dd�d����}|sZq8z*tj|ddd�}|jd	kr�|�	|�Wq8ty�Yq8Yq80q8|S)
N�/etc/csf/csf.denyrDr�r�rQrFr�rr)
rr9rKr:rVrr�r�r�r�)rn�linesr\r�r�r r r!�csf_denied_networks�s 

r�cCs|j|vo|j|vS�N)�network_addressZbroadcast_address)Z	container�	candidater r r!�network_contains�sr�c
sXtti�}t|�dd��}tdt|�dt�p.t��}tdtdt|�dt�pLt���}||gggggd�}|sp|St	�}|�dd	�|d<t
|�}i�|�d
g�D�]}t|�dd�p�d�}||kr�q�t|�d
d��}	|d�|	|d��|�dg�D]�}
zDt
jt|
�d
d��dd���jdk�s4�jdk�s4�jj�s8Wq�Wnt�yRYq�Yn0|
�d��sxt�fdd�|D���r�|d�t���q�|	|t|
�dd��p�d�d��t��<q�q�t��fdd�d�d|�}|�s�|S|�d�}tjjddd�t�d����}
t�td�t�|
tj�|d k�r�td!�}|� ��rF|j!d"d#�nd}t"�}g}|D]P}t
j|dd��t�fd$d�|D���r�|d%�|�n|�|�|����qX|�r�t#�$��%�j&d&d'�}|jd(d)d*��|}|�r�|�'d+��s�|�(d+�|D]4}�|}|�(d,�)|||d-|d.|d/|���q�|�*�t�+|�,��Wd�n1�sV0Yt-d0d1d2�\}}|dk�r�|j.|d)d*�t-d0d1d2�|d3�d4|d5d��n|d6�/|��n|d7k�r�g}t-d8d9d2�\}}|dk�r$z d:d;�t0�1|��d<g�D�}Wnt�y"g}Yn0|D]�}t
j|dd��t�fd=d�|D���rd|d%�|��q(t-d>|d?d2�\}}|dk�r�|d6�|�|���n|d3�|d@|dAd���q(n|d3�dB�Wd�n1�s�0Y|d6D]:}t-dC|dDdEd2�t2�3dF��r�t-dG|dDdHd2��q�|d�sF|d3�rTt4dJi|��|S)KNZauto_block_bclass_enabledTrQZauto_block_bclass_threshold�Zauto_block_max_cclass_per_run)�enabled�	threshold�matched_groups�blocked�skipped_protected�skipped_existingr��firewall_backend�noner�r�rr�r^r�)r�r�r�r�rr�r�c3s|]}��|�VqdSr�)Zoverlaps�ryrer�r r!�	<genexpr>r|z)automatic_bclass_block.<locals>.<genexpr>r�)�group�group_countr�cs�|d�|d|fS)Nr�r�r r�)�
candidatesr r!r�r|z(automatic_bclass_block.<locals>.<lambda>r�)�parents�exist_okza+i�r�r�rDr�c3s|]}t|��VqdSr��r�r�r�r r!r�&r|r�r"r#r&r'r(r+zL{} # wp-MM-System auto B-class>{} group={} total={} observed_cclass={} - {}
r�r�r�zcsf -r�xrHr�zCSF reload failed: ����r��wpmm_nftz$/usr/local/sbin/wpmm-firewall statusrcSsg|]}tj|dd��qS)Fr�)r�r�r�r r r!r{Ar|z*automatic_bclass_block.<locals>.<listcomp>Z	permanentc3s|]}t|��VqdSr�r�r�r�r r!r�Fr|z"/usr/local/sbin/wpmm-firewall add rz: i8���zNo supported firewall backendztimeout 10 ss -K dst z >/dev/null 2>&1 || true�Z	conntrackzconntrack -D -s r�automatic_bclass_cclass_block)r�)5r=�CONFIG_FILEr�rX�maxrW�AUTO_BCLASS_THRESHOLD�min�AUTO_BLOCK_MAX_CCLASS_PER_RUN�connection_detailsr�rar�r�r�r�Z	prefixlenr�r�r:�anyr��AUTO_BLOCK_LOCK�parent�mkdirr0rC�chmod�fcntlZflockZLOCK_EXr�existsr9r�rr,r-r.�endswithr1�format�flush�fsync�filenorrBr�r2r8r�r�r7)r�r�r��limitrnZanalysisr�r�r�Z
group_namerzZorderedZbackend�lockZ	deny_path�originalZdeniedZ	additions�targetZstampr6r4rMrN�existingZstatus_codeZ
status_outputr )r�r�r!�automatic_bclass_block�s�
 "
$*



*.


 

$.r�cCstti�}t|�dg�t�}tddd�\}}i}i}i}i}|dk�r|��D�]�}|��}	|	rh|	dnd}
|�|
d�d||
<|
dkr�t|	�d	kr�t	|	d
�\}}|�|d�d||<d}
t|	�d	kr�t	|	d�\}}
|
d
k�r`t
|
����r`t|
�dv�r`|�dd�d|d<t	|	d
�\}}|�
|did��}|dd7<|d�|
d�d|d|
<|
}|
d
k�r�t
|
����r�t|
�|v�r�d}|�|d�d||<|dvrNt|	�d	krNt	|	d
�\}}|�
|did��}|dd7<|d�|d�d|d|<qNdd�t|��dd�d�dd�D�|d<t|�|d<dd�t|��d d�d�dd!�D�|d"<t|�dd!�|d#<d$d�t|��d%d�d�dd!�D�|d&<tt�d'��|d(<tt�d'��p�t�d)��o�t�d*��|d+<t�d'��r�d'nt�d)��rt�d*��rd,nd-|d.<|S)/N�auto_block_established_ports�ss -antHrrHrZUNKNOWNrQ�SYN-RECV�rrr^r�ESTAB)rrzESTABLISHED-NON-HTTP)r��portsr�r��ESTABLISHED-UNEXPECTED�r��
CLOSE-WAIT�LAST-ACKr�)r�r�r�cSsg|]\}}||d��qS)r�r )ryr�r�r r r!r{|s�z"socket_metrics.<locals>.<listcomp>cSs|d|dfS�NrQrr �rzr r r!r�~r|z socket_metrics.<locals>.<lambda>r���top_syn_sources�abnormal_source_countcSs$g|]\}}||d|dd��qS)r�r�)r�r�r�r �ryr�r4r r r!r{�s�cSs|dd|dfS�NrQr�rr r�r r r!r��r|r��top_abnormal_sources�top_abnormal_networkscSs$g|]\}}||d|dd��qS)r�r�)r�r�r�r rr r r!r{�s�cSs|dd|dfSrr r�r r r!r��r|Z top_non_http_established_sourcesr��
csf_available�
wpmm-firewall�nft�firewall_availabler�r�r�)r=r�rorX�#DEFAULT_HIGH_RISK_ESTABLISHED_PORTSrrKrVr�rira�isdigitrWr�r�r�r�r�r�r�)r��high_risk_portsrMrNZcountsZsyn_sourcesZnon_http_established_sourcesZabnormal_sourcesrZr�r�Zpeer�_�
local_portrzZ
tracked_stater r r!�socket_metricsZs`

&&�
�
�
*4rcCstti�}tdd�|�dg�D��}t|�di�t�rB|�di�ni}t|�dg�t�}tddd�\}}|d	krxt	d
��i}i}i}|�
�D�]}	|	��}
t|
�dkr�q�|
d	}t
|
d�\}}
|d
kr�t|
���r�t|
�|vr�d}n
|dvr�q�t
|
d�\}}|�|d	�d||<|�|
d	�d||
<|�||d	iiid��}|dd7<|d�|d	�d|d|<|d�|
d	�d|d|
<|d�|d	�d|d|<q�t|�}t||�g}t|��dd�d�dd�D]�}|d|v|d<|�|dd�|d<dd �t|d��d!d�d�dd"�D�|d<d#d �t|d��d$d�d�dd"�D�|d<|�|��q�tt�d%��}tt�d&��o�t�d'��}t����jd(d)�t|���|t|�d*d �t|��d+d�d�dd,�D�||dd�||�p�||�r�d%n|�rd-nd.d/�
S)0Ncss&|]}t|���rt|���VqdSr��rarr�r r r!r��r|z%connection_details.<locals>.<genexpr>r�Zconnection_whitelist_labelsr�r�r
rHru無法讀取連線狀態r�rr�r�)r�r�r�rrrQ)r�r�r��target_ports�target_addressesr�r�rrcSs|d|dfSr�r r�r r r!r��r|z$connection_details.<locals>.<lambda>r��dr�r�r^Zwhitelist_labelcSsg|]\}}||d��qS�)rhr�r �ryrhr�r r r!r{�r|z&connection_details.<locals>.<listcomp>cSs|d|dfSr�r r�r r r!r��r|r�cSsg|]\}}||d��qS))rgr�r )ryrgr�r r r!r{�r|cSs|d|dfSr�r r�r r r!r��r|r�rrr"r#cSsg|]\}}||d��qSrr rr r r!r{�r|cSs|d|dfSr�r r�r r r!r��r|r�r�r�)
�
checked_at�totalr�r�Ztop_target_ports�sourcesr�rrr�) r=r�rjrXr�r�ror	r�RuntimeErrorrKrVr�rirar
rWr�r�r�r�rYr�r�r�r�r�rr,r-r.�sum)r�r��labelsrrMrNrr�r�rZr�r�Zlocal_ipr
Zpeer_iprrzr�r�rZwpmm_nft_availabler r r!r��s^
" 
 ..$�r�c	Cs�i}dD]�\}}z�t�|�}|j|j}|j|j}|j}|j}t|dd�||d<|rpt||d|d�nd||d<|r�t||d|d�nd||d<Wqty�d||d<d||d<d||d<Yq0q|S)	N))�root�/)�homez/homeg�Ar>Z	_total_gb�Y@rQZ
_used_percentZ_inode_used_percent)	rC�statvfs�f_blocks�f_frsize�f_bavail�f_files�f_favail�roundr:)rnZlabelZmount�statrZ	availableZinode_totalZ
inode_freer r r!�disk_metrics�s 
&*r'c
	Cstdd�td�����d��dd�D�}t|�}t|�dkrF|dndt|�dkr\|dnd}t|�dkrv|dnd}d}}td�����d	d�D]J}|�d
d�\}}|��dkr�q�|��}	|t|	d�7}|t|	d�7}q�d}
}td
���D]^}|j	�
d��rq�z4|d����}	|
t|	d	�7}
|t|	d�7}Wq�t�yVYq�0q�t��||||||
|d�S)NcSsg|]}t|��qSr )rWr�r r r!r{�r|z raw_counters.<locals>.<listcomp>z
/proc/statrrQrrrz
/proc/net/devr>rP�lor�z
/sys/block)ZloopZram�fdr&rq)r$�	cpu_total�cpu_idle�
cpu_iowait�rx_bytes�tx_bytes�read_sectors�
write_sectors)
rr9rKrVrr�rrW�iterdirrLrbr:r$)
�cpur*r+r,r-r.rZZ	interfacerY�fieldsr/r0Zdevicer r r!�raw_counters�s4*0
�r4cCs�t�}tti�}tt|�td|dt|�d|d���}|dt|�d|d��}|dt|�d|d��}|dt|�d|d��}|dkr�ttdt	d||d|��d	�nd|dkr�ttd|d|�d	�ndttd|d
t|�d
|d
���|dd	�ttd|dt|�d|d���|dd	�ttd|d
t|�d
|d
���d|dd	�ttd|dt|�d|d���d|dd	�d�S)Ng����MbP?r$r*r+r,rgrrQr-g�@r.r/g�@r0)�cpu_percent�io_wait_percent�network_rx_kbps�network_tx_kbps�disk_read_kbps�disk_write_kbps)
r4r=�
COUNTERS_FILErFr��floatrXrWr%r�)�currentZprevious�elapsedZ	cpu_deltaZ
idle_deltaZiowait_deltar r r!�rate_metrics�s

","..22�r?cCs�d�|�}t|dd�\}}g}|dkr�|��D]|}|�dd�}t|�dkr.zL|�t|d�|dt|d�t|d	�t|d
�|ddd�d��Wq.ty�Yq.0q.|S)
NzAps -eo pid=,user=,pcpu=,pmem=,etimes=,comm= --sort=-{} | head -10r�rHrr�rqrQr>rrrr)�pid�userr2�memoryr"rw)	r�rrKrVr�r�rWr<r:)Zsort_keyrrMrNr�rZr�r r r!�
top_processess
LrCcCs�tddd�\}}d|vr,|�dd�d��n|}g}td�}|��rftddd�\}}dd	�|��D�}td
dd�\}}dd	�|��D�dd�}|t|�||��r�t�	|�
�j���j
d
d�nd|d�S)Nz#chage -l root 2>/dev/null | head -1rGrHrPrQz/root/.ssh/authorized_keysz5ssh-keygen -lf /root/.ssh/authorized_keys 2>/dev/nullcSs g|]}|��r|dd��qS)N��)r�ryrZr r r!r{r|z!root_security.<locals>.<listcomp>zlast -n 5 -Fai root 2>/dev/nullcSs"g|]}|�d�r|dd��qS)zroot N�,)rbrEr r r!r{r|r�r"r#r^)�password_changedZauthorized_key_countZauthorized_key_fingerprintsZauthorized_keys_mtimeZrecent_root_logins)rrVrr�is_filerKr�r�rZ
fromtimestampr&�st_mtimer-r.)rZpassword_outputrG�keysZkey_pathZ
key_outputZlogin_outputZloginsr r r!�
root_securitys &�rKcCstddd�ddkrdSdS)Nz8pgrep -x php-fpm >/dev/null || pgrep -x lsphp >/dev/nullrGrHrrIZinactive)rr r r r!�php_fpm_status(srLcs�tti�}t��tdd�|�dg�D��}|�t|�dt�����t	�fdd�dD��}��dg�D]}|�d�|v|d	<qf��d
g�D]}|�d�|v|d	<q�t
��dg�|�dd
���d
g�D�}tdd
�|D�p�dg�}|tkr�dn,|t
k�rt��dd��p
d�tk�rdnd}t�}t��\}}	}
t|�dd��}td|�d�dd�\}}
t�}dd�dD�}t�|d<tddd�\}}t|�}t����jd d!�t��j|t|
���||���r�t|�ndtt� d"��t�!��p�d#|d$|d%d&�t"|d'�t"|	d'�t"|
d'�d(�|�||t
t#tt||t$|�d)�t%t&�|d*|d+d,�|d-|d.d/�t'd0�t'd1�t(�tt)d2id3��ttd4dd�d#�p�d�ttd5dd�d#�p�d�d6�}g�|d7d8td9t�!��p�d#d'�k�rڈ�*d:�|d$du�r|d$d;k�r��*d<�|d%du�r&|d%d=k�r&��*d>�|d?d@k�r>��*dA�|dB�rh|dC|dBdDk�rh��*dE�|t#k�r|��*dF�|dk�r���*dG�n|dk�r���*dH���dId�t#k�rˆ�*dJ���dKd���dLd�t+k�r��*dM���dNd�dk�r��*dO�|�dPd�dk�r"��*dQ�|dR�s6��*dS�t,dTd�|dU�-�D���r\��*dV�|dWdXv�rt��*dY�|dZd[du�r�|dZd[d;k�r���*d\��|d]<t,�fd^d�d_D���r�d`n��r�dandb|dc<|S)dNcss&|]}t|���rt|���VqdSr�rr�r r r!r�/r|zquick_report.<locals>.<genexpr>r�Z
controller_ipc3s"|]}t��|d�pd�VqdS)rN�rWrX)ryr�)�socketsr r!r�1r|r�r�r�r�rrcSsg|]}|�d�s|�qS)r�)rX�ry�sourcer r r!r{7r|z quick_report.<locals>.<listcomp>cSs g|]}t|�dd�pd��qS)r�rrMrOr r r!r{8r|rZconcentratedrZdistributedr�rprzss -lntH 'sport = :�'rGrHcSsi|]}|t|��qSr )rO�ryrLr r r!�
<dictcomp>Ar|z quick_report.<locals>.<dictcomp>)�sshd�httpd�mariadbZcpanelZphp_fpmzOcurl -k -sS -o /dev/null -w '%{http_code}' --max-time 8 https://127.0.0.1:2087/r�r"r#r�rQr5r6)ZcoresZ
usage_percentr6r>)�1mZ5mZ15m)�abnormal_totalZwarning_thresholdZcritical_thresholdZconcentrated_source_thresholdZdistributed_source_threshold�patternZmax_non_whitelist_source_count�
whitelist_ipsr9r:)Z	read_kbpsZ
write_kbpsr7r8)Zrx_kbpsZtx_kbpsZpcpuZpmemr^)r�summaryzpgrep -af 'php|lsphp' | wc -lz#ps -eo stat= | grep -c '^Z' || true)rZhostnamerp�
ssh_listening�services�whm_http_statusrr2�loadrBrNr�Zconnection_analysis�diskr�Ztop_cpuZ
top_memoryrK�wordpress_securityZ
php_processesZzombiesr_rWr�Z	load_high�ZZcpu_highrZio_wait_highrSrR�
memory_lowrTrUg333333�?Z	swap_high�abnormal_connections_criticalZconcentrated_attack_suspectedZdistributed_scan_suspectedr�Zsyn_flood_suspectedr�r�Zhttp_connections_stuckr�Z"unexpected_established_connectionsr~Zunexpected_public_listenersr\�ssh_not_listeningcss|]}|dkVqdS)rINr r�r r r!r�sr|r]�service_inactiver^)ri-i.Z
whm_unhealthyr`Zroot_used_percentZ	disk_high�warningsc3s|]}|�vVqdSr�r )ry�x)rgr r!r�wr|)rcrerfrdZcriticalZwarningZhealthy�severity).r=r�rrjrXrlra�HAWK_IPrrr�r��CONCENTRATED_SOURCE_THRESHOLD�CONNECTION_WARNING_THRESHOLDrW�DISTRIBUTED_SOURCE_THRESHOLDr]rC�
getloadavgrr?rLr�rr,r-r.�uname�nodenamer�r
r�r��	cpu_countr%�CONNECTION_CRITICAL_THRESHOLDr�r�r'rCrK�
SECURITY_FILEr��BAD_CONNECTION_THRESHOLDr�rY)r�rZrXrPZnon_whitelist_sourcesZmax_source_countZconnection_patternrBZload1Zload5Zload15rprZ
listen_outputZratesr]Zwhm_coder��reportr )rNrgr!�quick_report,s�
,�

�
� 0&&*(&..rvcCs�i}td�}|��s|Sdddd�}|jdd���D]�}|�d�}t|�d	ks4d
|dvr\q4|d�d
d�d��}|d��|d��}}|r4||vs�|�|d�|�||dd�kr4||f||<q4|S)
Nz/etc/userdatadomainsrr>rQ)�mainZaddon�subrDr�z==r�rPrrr)rr�r9rKrVr�rrX)rnr;Zpriorityr\r��domain�kindrr r r!�discover_sites{s
,r{cs�hd�}ddddddd�}g}t���D�]�\}\}}|dd7<t|�}|ggggd��|d��s��d�d�|d	d7<d
D]}||��s��d�|�q�t�fdd�d
D��r�|d
d7<|���rXzf|��D]X}|���r|j�	�|v�r�d�t
|��|��r�t�d|j�r�d�t
|��q�Wnt
�yVYn0|dd}	|ddd��}
|	���rvt�|	�D]�\}}}|D]�}|�	�}
d|
v�r�|
dv�r�t|�|}zP|�|	�}|
�r|j�r|jd�	�dk�rd|jdd�dd�v�rW�q�Wnt
�y*Yn0�d�t
|��t�d�dk�r��qZ�q�t�d�dk�r��qv�q�dD]}||t�|�7<�qzt����r(�d�s̈d�s̈d�s̈dr(t|�dkr(|���q(||d �S)!N>zwp-log1n.phpzdefaults.phpzbuy.phpznetworks.phpz1337.txtz	click.phpr)�sites�known_files�random_dirs�uploads_php�config_missing�core_missingr|rQ)ryr}r~r�missingz
wp-config.phpr�r�)zwp-adminzwp-includes�
wp-contentc3s|]}|�dvVqdS)r�Nr rR�Zfindingr r!r��r|zdeep_scan.<locals>.<genexpr>r�r}z[0-9a-fA-F]{5,6}r~r��uploadsZpluginszsucuri-scannerz.php>z	index.phpz	locoy.phpZsucurizexit(0);rDr�rFrr)r}r~rr)r[�samples)r{r�rrHr��is_dirr�r1rLr�ra�re�	fullmatchr:rC�walk�relative_tor�r9r�rY)Zknownr[r�rryrr;rL�childr�Zsucuri_installedr=�filesr�r��relativer[r r�r!�	deep_scan�sN*&
,.

<
2r�cCsft�d�sdStd�}|��r2t|jdd�vr2dStdt�d�d	d
�\}}|dkrVdSd
|dd�S)Nr�Zcsf_not_installedr�rDr�Zalready_allowedzcsf -a z# 'Allow Hawk wp-MM-System watchdog'rrHrrxzfailed: r�)r�r�rr�rjr9r)Z
allow_filerMrNr r r!�ensure_hawk_allow�s
r�FcCsJt�}g}|�dt�i�|d}|dddks:|ds�tddd	�\}}|d
krr|�dtdd
d	�d
d
ki�n|�d|dd�d��dD]<}|d|dkr�|�d|td|��dd	�d
d
ki�q�|d�dd
�|d�dd
�}|tks�|�r>td����rdnd}	t|	dd	�\}}
|�|d
k||
dd�d��|�r�d}td����r�t|dd	�\}}
|�|d
k|
dd�d ��|d!}|d"d
k�r�|d#|d"d$k�r�td%d&d	�\}}
|�|d
k|
dd�d'��n|�dd(d)��t�	d*�t�}
|�rd+n|�rd,nd-|||
d.�}t
d/|d0||d1|
d1d2�tt|
�|S)3NZ
hawk_allowrpr]rTrIr\�sshd -trrHr�restart_sshd�systemctl restart sshdrFr�)r��reason)rUrVZstart_�systemctl start rrNr�r��/scripts/restartsrv_httpd�$/scripts/restartsrv_httpd --graceful�apachectl gracefulrb)Zapache_gracefulZstuck_beforer4z-/scripts/restartsrv_apache_php_fpm --gracefulz"/scripts/restartsrv_apache_php_fpmr�)Zphp_fpm_gracefulr4rBrUrSizswapoff -a && swapon -a�)�
swap_resetr4u-可用記憶體不足,為安全起見跳過)r�r�r>�	automatic�	emergencyZsafe)�mode�before�actions�after�repairr�ri)r�r�Zbefore_severityZafter_severity)
rvr�r�rrXrtrr�r$�sleepr7rF�STATUS_FILE)r�r�r�r�rprM�check�service�stuckrrNZphp_commandrBr�rnr r r!r��sB * $
"
r�c
Cs,ttddd��}t�}t�t�}dt����jdd�i|�|d<|d|d<dD]2}|d	|d
krRt	d|��dd
�t
d|d�qR|ds�t	ddd
�ddkr�t	ddd
�t
d|dd�|d�dd�|d�dd�}|tkr�|�dd�dnd|d<t
t���}|dtk�r�||�dd�tk�r�td����r@dnd }t	|d!d
�\}}||d<d|d<t
d"|dk||d#d�d$�tti�}	t��t|	�d%d��p�d�d&k�r�t�}
t����jdd�t��|
�d'i�d(�}	tt|	�|	|d)<tt|�tt|�t
d*|d+|d,|t|�d-g��d.�dS)/Nr)�
pressure_runs�
last_gracefulrr"r#Zlast_auto_blockZautomatic_bclass_protection)rTrUrVr]rIr�rrHZservice_self_heal)r�r\r�rr�rZssh_listener_self_healrp)rhrNr�r�r�rQr�r�r�r�rbZautomatic_apache_gracefulr�)Zsuccess�stuck_connectionsr4�
checked_epochi�Qr[�rr�r[rar�rirgr�)rirgr�Zauto_blocked)r=�
STATE_FILErvr�r�rr,r-r.rr7rXrtrWr$�CONSECUTIVE_THRESHOLD�GRACEFUL_COOLDOWNrr�rsr<r�rFr�r�)r�ruZ
auto_blockr�r�r,rrMrN�security�scanr r r!�automatic_check�s>   $
$(


r�cCs,t��}|jddd�|jddd�|jddd�|jddd�|jddd�|��}tjdd	d	d
�|jr�ttj	t
�ddd
��n�|js�|jr�ttj	t|jd�ddd
��nz|j
�r"t�}|j�rt�|d<t����jdd�t��|d�di�d�}tt|�||d<ttj	|ddd
��nt�dS)Nz--report�
store_true)�actionz--deepz--repairz--emergencyz
--connectionsi�T)r�r�r�Fr>r?)r�Zwordpress_scanr"r#r[r�ra)�argparse�ArgumentParser�add_argument�
parse_args�	STATE_DIRr�Zconnections�printr2r3r�r�r�rurvZdeepr�rr,r-r.r$rXrFrsr�)�parser�argsrnr�r r r!rws*
,
rw�__main__)r)r )FF)@r�r�r�r2rCr�r�rr$r�pathlibrr�r�r�r;rsr/r�rjrtrlrrrkrmr�r�r�r�r�r	rrr7r=rFrOr]riror�r�r�r�r�r�r�r�rr�r'r4r?rCrKrLrvr{r�r�r�r�rw�__name__r r r r!�<module>s~

 `63O*

&"


Current_dir [ 𝗡𝗢𝗧 𝗪𝗥𝗜𝗧𝗘𝗔𝗕𝗟𝗘 ] Document_root [ 𝗪𝗥𝗜𝗧𝗘𝗔𝗕𝗟𝗘 ]

Current_dir [ 𝗡𝗢𝗧 𝗪𝗥𝗜𝗧𝗘𝗔𝗕𝗟𝗘 ] Document_root [ 𝗪𝗥𝗜𝗧𝗘𝗔𝗕𝗟𝗘 ]


[ Back ]
𝗡𝗔𝗠𝗘
𝗦𝗜𝗭𝗘
𝗟𝗔𝗦𝗧 𝗧𝗢𝗨𝗖𝗛
𝗨𝗦𝗘𝗥
𝗦𝗧𝗔𝗧𝗨𝗦
𝗙𝗨𝗡𝗖𝗧𝗜𝗢𝗡𝗦
..
--
10 Sep 2026 4.28 AM
root / root
0755
wpmm-firewallcpython-39.pyc
6.804 KB
10 Sep 2026 1.32 AM
root / root
0600
wpmm-watchdogcpython-39.pyc
31.633 KB
10 Sep 2026 4.28 AM
root / root
0644

✘✘ GRAYBYTE WORDPRESS FILE MANAGER @ 2026 CONTACT ME ✘✘
Static GIF Static GIF