Nukemalware V29 🛠️✨

cat << 'EOF' > wp-nuke.sh
#!/bin/bash
echo "🔥 WAKTUNYA BEBERSIH PENYAKIT MU-PLUGIN GILA 🤓"
WCMD="wp"
if [ -f "/var/softaculous/wp/wp-cli" ]; then
  WCMD="php /var/softaculous/wp/wp-cli"
fi
SLOG="/tmp/wpsum_$$.log"
> "$SLOG"

nuke() {
  T="$1"; R="$2"; FN=$(basename "$T")
  case "$FN" in
    functions.php|header.php|index.php) ;;
    wp-config.php|footer.php|wp-settings.php|wp-load.php) ;;
    *)
      chattr -i "$T" 2>/dev/null
      chmod 777 "$T" 2>/dev/null
      rm -f "$T" 2>/dev/null || > "$T"
      echo "DELETED|$T|$R" >> "$SLOG"
      DIR=$(dirname "$T")
      find "$DIR" -maxdepth 1 -name "index.php" -size -200c \
        -delete 2>/dev/null
      if [ -d "$DIR" ] && [ -z "$(ls -A "$DIR" 2>/dev/null)" ]; then
        rm -rf "$DIR" 2>/dev/null
      fi
      ;;
  esac
}

SAVEIFS=$IFS; IFS=$'\n'
for CFG in $(find "$(pwd)" -type f -name "wp-config.php" 2>/dev/null); do
  WDIR=$(dirname "$CFG"); WCON="$WDIR/wp-content"
  
  chattr -R -i "$WDIR" 2>/dev/null
  find "$WDIR" -type d -exec chmod 755 {} + 2>/dev/null
  find "$WDIR" -type f -exec chmod 644 {} + 2>/dev/null

  # Sikat Sarang Zombie
  find "$WCON" -maxdepth 1 -type d -name ".sc_*" -exec rm -rf {} + 2>/dev/null
  
  BP="$WDIR/.b.php"
  cat << 'PHP_EOF' > "$BP"
<?php
$f=$argv[1];
if(is_file($f) && is_writable($f)){
 $c=file_get_contents($f);
 $o=$c;
 
 // 1. Full Wrapper (Mencegah parse error)
 $c=preg_replace('/if\s*\(\s*!\s*isset\s*\(\s*\$_sc_done\s*\)\s*\)\s*\{.*?\$_sc_done\s*=\s*false\s*;\s*die\s*\(\s*\'SC_FAIL\'\s*\)\s*;\s*\}/is', '', $c);
 
 // 2. Blok Malware Standar
 $p='/\/\*\s*(\.wp-[a-z-]+|SC_[A-Z0-9_]*BEGIN|SCOCV:).*?\/\*\s*SC_[A-Z0-9_]*END[^\*]*\*\//us';
 $c=preg_replace($p, '', $c);
 
 // 3. Sapu Buntut Ketinggalan (Syntax error Unmatched '}')
 $c=preg_replace('/\$_sc_done\s*=\s*false\s*;\s*die\s*\(\s*\'SC_FAIL\'\s*\)\s*;\s*\}/is', '', $c);
 
 // 4. Sapu Kepala Ketinggalan
 $c=preg_replace('/if\s*\(\s*!\s*isset\s*\(\s*\$_sc_done\s*\)\s*\)\s*\{\s*\$_sc_done\s*=\s*true\s*;/is', '', $c);

 if($c !== $o && $c !== null){
  file_put_contents($f, $c);
  echo "OK_PHP";
 }
}
PHP_EOF

  STMP="$WDIR/.s.tmp"
  
  # PENAMBAHAN V29: Cari seluruh SC_FAIL & $_sc_done di Plugin/Theme
  find "$WDIR" -type f -name "*.php" \
    -exec grep -lE "(SC_[A-Z0-9_]+BEGIN|SCOCV:|\$_sc_done|SC_FAIL)" {} + > "$STMP" 2>/dev/null
    
  while IFS= read -r inf; do
    if [ -n "$inf" ] && [ -f "$inf" ]; then
      cp "$inf" "$inf.bak" 2>/dev/null
      if [[ $(php "$BP" "$inf" 2>/dev/null) == *"OK_PHP"* ]]; then
        echo "CLEANED|$inf|PHP_REPAIR" >> "$SLOG"
        rm -f "$inf.bak" 2>/dev/null
      else
        # Fallback SED jika ada yang membandel
        S1="\/\*[[:space:]]*SC_[A-Z0-9_]*BEGIN"
        S2="\/\*[[:space:]]*SC_[A-Z0-9_]*END.*\*\/"
        sed -i.bak2 "/$S1/,\/$S2/d" "$inf" 2>/dev/null
        sed -i.bak3 "s/\$_sc_done *= *false; *die( *'SC_FAIL' *); *}//g" "$inf" 2>/dev/null
        rm -f "$inf.bak2" "$inf.bak3" 2>/dev/null
        
        echo "CLEANED|$inf|SED" >> "$SLOG"
        if ! head -n 1 "$inf" | grep -q "<?php"; then
          sed -i '1s/^/<?php\n/' "$inf" 2>/dev/null
        fi
      fi
    fi
  done < "$STMP"
  rm -f "$BP" "$STMP" 2>/dev/null

  PFX=$(grep "\$table_prefix" "$CFG" | cut -d "'" -f 2 | head -n 1)
  if [ -n "$PFX" ]; then
    DBN=$(grep -E "define\s*\(\s*'DB_NAME'" "$CFG" | cut -d "'" -f 4)
    DBU=$(grep -E "define\s*\(\s*'DB_USER'" "$CFG" | cut -d "'" -f 4)
    DBP=$(grep -E "define\s*\(\s*'DB_PASSWORD'" "$CFG" | cut -d "'" -f 4)
    DBH=$(grep -E "define\s*\(\s*'DB_HOST'" "$CFG" | cut -d "'" -f 4)
    
    if command -v $WCMD &> /dev/null; then
      CTMP="$WDIR/.c.tmp"
      $WCMD cron event list --fields=hook --format=csv \
        --path="$WDIR" > "$CTMP" 2>/dev/null
      while IFS= read -r hk; do
        if echo "$hk" | grep -qE "^[a-z0-9]{12,40}$"; then
          echo "CRON|$hk" >> "$SLOG"
          find "$WCON" -type f -name "*.php" \
            -exec grep -l "$hk" {} + > "$STMP" 2>/dev/null
          while IFS= read -r inf; do
            if [ -n "$inf" ]; then
              nuke "$inf" "CronHook_$hk"
            fi
          done < "$STMP"
          $WCMD cron event delete "$hk" --path="$WDIR" 2>/dev/null
        fi
      done < "$CTMP"
      rm -f "$CTMP" "$STMP" 2>/dev/null
    fi
    Q="DELETE FROM ${PFX}options WHERE option_name='cron';"
    MYSQL_PWD="$DBP" mysql -u"$DBU" -h"$DBH" "$DBN" -e "$Q" 2>/dev/null
  fi
  
  P1="$WCON/plugins"; P2="$WCON/themes"
  FA='static $a=null;if($a===null){$a=array'
  if [ -d "$P1" ]; then
    find "$P1" "$P2" -type f -name "*.php" \
      -exec grep -lF "$FA" {} + > "$STMP" 2>/dev/null
  fi
  while IFS= read -r inf; do
    [ -n "$inf" ] && nuke "$inf" "Forge APT"
  done < "$STMP"

  EA='eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate)'
  if [ -d "$P1" ]; then
    find "$P1" "$P2" -type f -name "*.php" \
      -exec grep -lE "$EA" {} + > "$STMP" 2>/dev/null
  fi
  while IFS= read -r inf; do
    [ -n "$inf" ] && nuke "$inf" "Eval BD"
  done < "$STMP"
  
  rm -f "$WDIR/.user.ini" "$WDIR/php.ini" 2>/dev/null
  rm -f "$WCON/.user.ini" "$WCON/php.ini" 2>/dev/null
  rm -f "$STMP" 2>/dev/null
  
  find "$WCON" -maxdepth 1 -type f -name ".*" \
    ! -name ".htaccess" -exec rm -f {} + 2>/dev/null
  
  if [ -d "$WCON/mu-plugins" ]; then
    rm -rf "$WCON/mu-plugins" 2>/dev/null
    echo "DELETED|$WCON/mu-plugins|mu-plugins" >> "$SLOG"
  fi

  find "$WCON" -maxdepth 1 -type f \( -name "*.zip" -o \
    -name "*.tar.gz" -o -name "*.ico" \) > "$STMP" 2>/dev/null
  while IFS= read -r f; do
    if [ -n "$f" ]; then
      rm -f "$f" 2>/dev/null
      echo "DELETED|$f|Zip Payload" >> "$SLOG"
    fi
  done < "$STMP"

  # Sikat file root dan cache palsu (object-cache.php dll)
  find "$WCON" -maxdepth 1 -type f -name "*.php" > "$STMP" 2>/dev/null
  while IFS= read -r f; do
    fn=$(basename "$f")
    case "$fn" in
      index.php) ;; 
      *) rm -f "$f" 2>/dev/null; echo "DELETED|$f|Root/Cache PHP" >> "$SLOG" ;;
    esac
  done < "$STMP"
  rm -f "$STMP" 2>/dev/null
  
  if [ -d "$WCON/uploads" ]; then
    find "$WCON/uploads" -type f -name "*.php" \
      -exec rm -f {} + 2>/dev/null
  fi

  # Normalisasi .htaccess Mutlak
  HT="$WDIR/.htaccess"
  chattr -i "$HT" 2>/dev/null
  echo "# BEGIN WordPress" > "$HT"
  echo "<IfModule mod_rewrite.c>" >> "$HT"
  echo "RewriteEngine On" >> "$HT"
  echo "RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]" >> "$HT"
  echo "RewriteBase /" >> "$HT"
  echo "RewriteRule ^index\.php$ - [L]" >> "$HT"
  echo "RewriteCond %{REQUEST_FILENAME} !-f" >> "$HT"
  echo "RewriteCond %{REQUEST_FILENAME} !-d" >> "$HT"
  echo "RewriteRule . /index.php [L]" >> "$HT"
  echo "</IfModule>" >> "$HT"
  echo "# END WordPress" >> "$HT"
  chmod 644 "$HT" 2>/dev/null
  
done
IFS=$SAVEIFS

echo -e "\n======================================="
echo "LAPORAN AKHIR DARI MU-PLUGIN GILA 🤓"
echo "======================================="

echo "[+] FILE CORE DIBERSIHKAN (SYNTAX REPAIRED):"
C1=$(grep -c "^CLEANED|" "$SLOG" 2>/dev/null)
if [ "$C1" -gt 0 ]; then
  grep "^CLEANED|" "$SLOG" | while IFS='|' read -r s f m; do
    echo " -> $f ($m)"
  done
else
  echo " -> Nihil."
fi

echo -e "\n[+] FILE/FOLDER DIHAPUS PERMANEN:"
C2=$(grep -c "^DELETED|" "$SLOG" 2>/dev/null)
if [ "$C2" -gt 0 ]; then
  grep "^DELETED|" "$SLOG" | while IFS='|' read -r s f r; do
    echo " -> $f ($r)"
  done
else
  echo " -> Nihil."
fi

echo -e "\n[+] CRON MALWARE DIBUNUH:"
C3=$(grep -c "^CRON|" "$SLOG" 2>/dev/null)
if [ "$C3" -gt 0 ]; then
  grep "^CRON|" "$SLOG" | while IFS='|' read -r s h; do
    echo " -> Hook: $h"
  done
else
  echo " -> Nihil."
fi

rm -f "$SLOG" 2>/dev/null
echo "======================================="
echo "SELESAI. SYNTAX ERROR SEMBUH 👻. .htaccess NORMAL 🚀"
EOF
chmod +x wp-nuke.sh
./wp-nuke.sh