File: /home/msgdhg02/.bash_history
#1788600204
echo "=== 1. เช็ค wp-cli ==="
#1788600204
which wp || echo "wp-cli ไม่มี ต้องติดตั้งก่อน"
#1788600204
echo "=== 2. รายชื่อเว็บทั้งหมดในบัญชีนี้ ==="
#1788600204
ls ~/public_html/ 2>/dev/null
#1788600204
find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null
#1788600205
echo "=== 3. จำนวนเว็บ WordPress ทั้งหมด ==="
#1788600205
find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null | wc -l
#1788600205
echo "=== 4. เช็ค user ทุกเว็บ (หา user แปลกปลอมที่สร้างพร้อมกันจำนวนมาก) ==="
#1788600205
for f in $(find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null); do d=$(dirname "$f"); echo "--- $d ---"; wp user list --path="$d" --allow-root --fields=ID,user_login,user_registered,roles 2>&1 | head -10; done
#1788600381
echo "=== 5. สแกนโค้ดร้ายแฝง (whitespace heuristic แบบเดียวกับเซิร์ฟแรก) ==="
#1788600381
find ~/public_html -name "*.php" -print0 2>/dev/null | xargs -0 awk '
FNR==1 {
if ($0 ~ /^<\?php/) {
rest = substr($0, 6)
n = 0
while (substr(rest, n+1, 1) == " " || substr(rest, n+1, 1) == "\t") n++
if (n > 30) print FILENAME
}
}' > ~/infected_server2.txt
#1788600476
echo "=== 1. เช็ค wp-cli ==="
#1788600476
which wp || echo "wp-cli ไม่มี ต้องติดตั้งก่อน"
#1788600476
echo "=== 2. รายชื่อเว็บทั้งหมดในบัญชีนี้ ==="
#1788600476
ls ~/public_html/ 2>/dev/null
#1788600477
find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null
#1788600477
echo "=== 3. จำนวนเว็บ WordPress ทั้งหมด ==="
#1788600477
find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null | wc -l
#1788600477
echo "=== 4. เช็ค user ทุกเว็บ (หา user แปลกปลอมที่สร้างพร้อมกันจำนวนมาก) ==="
#1788600477
for f in $(find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null); do d=$(dirname "$f"); echo "--- $d ---"; wp user list --path="$d" --allow-root --fields=ID,user_login,user_registered,roles 2>&1 | head -10; done
#1788600642
echo "=== 5. สแกนโค้ดร้ายแฝง (whitespace heuristic แบบเดียวกับเซิร์ฟแรก) ==="
#1788600642
find ~/public_html -name "*.php" -print0 2>/dev/null | xargs -0 awk '
FNR==1 {
if ($0 ~ /^<\?php/) {
rest = substr($0, 6)
n = 0
while (substr(rest, n+1, 1) == " " || substr(rest, n+1, 1) == "\t") n++
if (n > 30) print FILENAME
}
}' > ~/infected_server2.txt
#1788601519
echo "พบไฟล์แฝงโค้ดร้าย: $(wc -l < ~/infected_server2.txt) ไฟล์"
#1788601519
cat ~/infected_server2.txt
#1788602366
> ~/no_real_user_domains.txt
#1788602366
> ~/full_user_list.txt
#1788602366
for f in $(find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null); do d=$(dirname "$f"); domain=$(basename "$d"); users=$(wp user list --path="$d" --allow-root --field=user_login 2>/dev/null); echo "--- $domain ---" >> ~/full_user_list.txt; echo "$users" >> ~/full_user_list.txt; if ! echo "$users" | grep -qE "^(seo-content|@admin_megabet333|admin_updraft)$"; then echo "$domain" >> ~/no_real_user_domains.txt; fi; done
#1788603139
echo "=== เว็บที่ไม่มี user จริงเลยสักตัว ==="
#1788603139
cat ~/no_real_user_domains.txt
#1788603139
echo ""
#1788603139
echo "จำนวน: $(wc -l < ~/no_real_user_domains.txt) เว็บ จากทั้งหมด 79 เว็บ"
#1788606341
mkdir -p ~/domain_removal_backup_$(date +%Y%m%d)
#1788606341
BACKUP_DIR=~/domain_removal_backup_$(date +%Y%m%d)
#1788606341
for domain in nokdang.com xn--12cm2bs5r.com luca333.net gone888b.com amb18b.com; do echo "=== Backup: $domain ==="; d=~/public_html/$domain; wp db export "$BACKUP_DIR/${domain}.sql" --path="$d" --allow-root 2>&1; tar czf "$BACKUP_DIR/${domain}_files.tar.gz" -C ~/public_html "$domain" 2>&1; ls -lh "$BACKUP_DIR/${domain}"* 2>&1; echo ""; done
#1788606477
echo "=== สรุป backup ทั้งหมด ==="
#1788606487
ls -lh "$BACKUP_DIR"
#1788606746
uapi DomainInfo list_domains
#1788606792
uapi DomainInfo domains_data | grep -B8 -A2 -E "nokdang\.com|xn--12cm2bs5r\.com"
#1788606829
echo "=== ลบ nokdang.com ==="
#1788606829
uapi AddonDomain delete_addon_domain domain=nokdang.com subdomain=nokdang
#1788606829
echo "=== ลบ xn--12cm2bs5r.com ==="
#1788606829
uapi AddonDomain delete_addon_domain domain=xn--12cm2bs5r.com subdomain=xn--12cm2bs5r
#1788606829
echo "=== เช็คผลลัพธ์ ==="
#1788606829
uapi DomainInfo list_domains | grep -E "nokdang|xn--12cm2bs5r"
#1788606831
echo "(ถ้าไม่เจอชื่อโดเมนพวกนี้แล้ว แปลว่าลบสำเร็จ)"
#1788606975
cat > ~/mass_user_cleanup.sh << 'SCRIPT_EOF'
#!/bin/bash
NEW_ADMIN_USER="msg_safeadmin"
NEW_ADMIN_PASS=$(openssl rand -base64 12)
NEW_ADMIN_EMAIL="invokoix@gmail.com"
REPORT=~/user_cleanup_report.txt
> "$REPORT"
CREATED_ON=""
for f in $(find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null); do
d=$(dirname "$f")
domain=$(basename "$d")
echo "=== $domain ===" >> "$REPORT"
reassign_id=""
csv=$(wp user list --path="$d" --allow-root --fields=ID,user_login --format=csv 2>/dev/null | tail -n +2)
for ku in "seo-content" "admin_updraft" "@admin_megabet333"; do
kid=$(echo "$csv" | awk -F',' -v u="$ku" '$2==u{print $1}')
if [ -n "$kid" ]; then reassign_id="$kid"; break; fi
done
if [ -z "$reassign_id" ]; then
wp user create "$NEW_ADMIN_USER" "$NEW_ADMIN_EMAIL" --role=administrator --user_pass="$NEW_ADMIN_PASS" --path="$d" --allow-root >> "$REPORT" 2>&1
reassign_id=$(wp user list --path="$d" --allow-root --fields=ID,user_login --format=csv 2>/dev/null | awk -F',' -v u="$NEW_ADMIN_USER" '$2==u{print $1}')
CREATED_ON="$CREATED_ON $domain"
echo "สร้าง admin สำรองที่ $domain (ID: $reassign_id)" >> "$REPORT"
fi
echo "$csv" | while IFS=',' read -r uid login; do
if [[ "$login" == "seo-content" || "$login" == "admin_updraft" || "$login" == "@admin_megabet333" || "$login" == "$NEW_ADMIN_USER" ]]; then
continue
fi
wp user delete "$uid" --reassign="$reassign_id" --path="$d" --allow-root --yes >> "$REPORT" 2>&1
done
done
echo ""
echo "=========================================="
echo "Admin สำรอง (ใช้ได้ทุกเว็บที่ถูกสร้าง):"
echo "Username: $NEW_ADMIN_USER"
echo "Password: $NEW_ADMIN_PASS"
echo "Email: $NEW_ADMIN_EMAIL"
echo "สร้างในเว็บ:$CREATED_ON"
echo "=========================================="
SCRIPT_EOF
#1788606978
bash ~/mass_user_cleanup.sh
#1788607746
echo "=== เช็คว่ามี error ระหว่างลบไหม ==="
#1788607746
grep -iE "error|warning|failed" ~/user_cleanup_report.txt | grep -v "^===" | head -30
#1788607746
echo ""
#1788607746
echo "=== เช็ค user ที่เหลือหลังลบ (สุ่มดู 5 เว็บ) ==="
#1788607746
for domain in bravo333d.com yum66z.com nokdang.com amb18b.com mro69v2.com; do echo "--- $domain ---"; wp user list --path=~/public_html/$domain --allow-root --fields=ID,user_login,roles 2>&1; done
#1788607813
for domain in bravo333d.com yum66z.com nokdang.com amb18b.com mro69v2.com; do echo "--- $domain ---"; wp user list --path="$HOME/public_html/$domain" --allow-root --fields=ID,user_login,roles 2>&1; done
#1788607911
cat > ~/clean_backdoor_server2.sh << 'SCRIPT_EOF'
#!/bin/bash
BACKUP_DIR=~/backdoor_backup_server2
mkdir -p "$BACKUP_DIR"
REPORT=~/backdoor_clean_report_server2.txt
> "$REPORT"
while IFS= read -r file; do
[ -f "$file" ] || continue
backup_path="$BACKUP_DIR/$(echo "$file" | sed 's|/|_|g')"
cp "$file" "$backup_path"
result=$(php -r '
$file = $argv[1];
$content = file_get_contents($file);
if (strpos($content, "<?php") !== 0) { echo "SKIP_NOT_PHP_START"; exit; }
$pos = strpos($content, "\n");
if ($pos === false) { echo "NO_NEWLINE"; exit; }
$firstLine = substr($content, 0, $pos);
$rest = substr($content, $pos);
file_put_contents($file, "<?php" . $rest);
echo "STRIPPED";
' "$file")
lint=$(php -l "$file" 2>&1)
if echo "$lint" | grep -q "No syntax errors"; then
echo "$file -> $result -> OK...CLEANED" >> "$REPORT"
else
cp "$backup_path" "$file"
echo "$file -> $result -> SYNTAX ERROR, RESTORED: $lint" >> "$REPORT"
fi
done < ~/infected_server2.txt
echo ""
echo "=== สรุปผล ==="
total=$(wc -l < ~/infected_server2.txt)
cleaned=$(grep -c "OK...CLEANED" "$REPORT")
restored=$(grep -c "RESTORED" "$REPORT")
echo "ไฟล์ทั้งหมด: $total"
echo "เคลียร์สำเร็จ: $cleaned"
echo "แก้ไม่ได้/restore กลับ: $restored"
echo "ดู log เต็มที่ $REPORT"
SCRIPT_EOF
#1788607914
bash ~/clean_backdoor_server2.sh
#1788608017
echo "=== 1. สแกนซ้ำ เผื่อมีไฟล์หลุดรอด ==="
#1788608017
find ~/public_html -name "*.php" -print0 2>/dev/null | xargs -0 awk '
FNR==1 {
if ($0 ~ /^<\?php/) {
rest = substr($0, 6)
n = 0
while (substr(rest, n+1, 1) == " " || substr(rest, n+1, 1) == "\t") n++
if (n > 30) print FILENAME
}
}' > ~/infected_recheck_server2.txt
#1788608462
echo "ไฟล์ที่ยังติดอยู่: $(wc -l < ~/infected_recheck_server2.txt)"
#1788608462
cat ~/infected_recheck_server2.txt
#1788608462
echo ""
#1788608462
echo "=== 2. หา webshell เดี่ยวๆ ในโฟลเดอร์แปลกปลอม ==="
#1788608462
find ~/public_html -path "*/cgi-bin/*.php" -o -path "*/.well-known/*.php" 2>/dev/null
#1788608502
find ~/public_html -path "*updraft*old*" -name "*.php" 2>/dev/null | grep -vE "wp-content/(themes|plugins)-old/(twentytwenty|updraftplus)/(patterns|includes|central|src)" | head -20
#1788608502
echo ""
#1788608502
echo "=== 3. เช็คสถานะเว็บที่เคย error ==="
#1788608502
for domain in gone888b.com nokdang.com xn--12cm2bs5r.com luca333.net amb18b.com; do curl -sk -o /dev/null -w "$domain -> HTTP %{http_code}\n" "https://$domain/"; done
#1788608576
mkdir -p ~/quarantine_webshells_server2
#1788608576
mv ~/public_html/luca333z.com/cgi-bin/objc.php ~/quarantine_webshells_server2/ 2>&1
#1788608576
mv ~/public_html/luca333z.com/.well-known/acme-challenge/sched_news.php ~/quarantine_webshells_server2/ 2>&1
#1788608576
mv ~/public_html/luca333z.com/.well-known/rvsindex.php ~/quarantine_webshells_server2/ 2>&1
#1788608576
echo "=== เช็คว่าลบแล้วเว็บยังปกติไหม ==="
#1788608577
curl -sk -o /dev/null -w "luca333z.com -> HTTP %{http_code}\n" "https://luca333z.com/"
#1788608605
echo "domain,http_status" > ~/final_status_server2.csv
#1788608605
for f in $(find ~/public_html -maxdepth 2 -name "wp-config.php" 2>/dev/null); do d=$(dirname "$f"); domain=$(basename "$d"); code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 "https://$domain/"); echo "$domain,$code" >> ~/final_status_server2.csv; done
#1788608737
echo "=== สรุปสถานะ ==="
#1788608737
awk -F',' 'NR>1{print $2}' ~/final_status_server2.csv | sort | uniq -c | sort -rn
#1788608737
echo ""
#1788608737
echo "=== เว็บที่ไม่ใช่ 200/301/302 (ต้องดูเพิ่ม) ==="
#1788608737
awk -F',' 'NR>1 && $2!=200 && $2!=301 && $2!=302 {print}' ~/final_status_server2.csv
#1788624400
find $HOME/public_html -maxdepth 1 -iname "*moneygame*"
#1788624409
DOMAIN="moneygame77b.com"
#1788624409
DPATH=$(find $HOME/public_html -maxdepth 2 -name "wp-config.php" -path "*$DOMAIN*" -exec dirname {} \;)
#1788624410
echo "path: $DPATH"
#1788624411
wp user list --path="$DPATH" --allow-root --fields=ID,user_login,user_email,roles
#1788624449
DOMAIN="moneygame77b.com"
#1788624449
DPATH="/home/msgdhg02/public_html/moneygame77b.com"
#1788624449
wp user create admin_seoMGB77 admin_seoMGB77@moneygame77b.com --role=administrator --user_pass='#MNG77admin$2026' --path="$DPATH" --allow-root
#1788624450
echo "--- ตรวจสอบ ---"
#1788624452
wp user list --path="$DPATH" --allow-root --fields=ID,user_login,user_email,roles