h0 d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z m
Z
ddl m Z ddl
mZmZmZ ddlmZ dd lmZmZmZ dd
lmZmZ dd lmZ dd l m Z dd
l m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ej+ e, Z- edej. Z/ ed Z0 ed Z1e0dz Z2e0dz Z3 G d dee Z4dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)Path) HookEvent)ANTIVIRUS_MODE SystemConfig) MessageType) MessageSink
MessageSourceexpect)
hosting_panel)
load_state
save_stateregister_lock_file)Scoperecurring_check)
check_lock)DAY)plugin) Wordpress)
MalwareHitWPSite)get_sites_by_path)is_secret_expired
rotate_secretz wp-gen-authz-/etc/sysconfig/imunify360/imunify360.config.dzF/opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.configz 11_on_first_install_wp_av.configz .11_on_first_install_wp_av.flagc F e Zd Zej Zd Zd Zd Zd Z d Z
d Z ddZ d Z
eed
ee d Z eej d
Z eej d Z eej d Z eej d Z dS )ImunifySecurityPluginc d | _ d | _ t d d | _ t d d p t
j | _ d | _ d | _ d S )Nr installedenabled)
_loop_sinkr getinstallation_completedr SECURITY_PLUGIN_ENABLEDlast_config_valueinstallation_task
deleting_taskselfs K/opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins/wordpress.py__init__z ImunifySecurityPlugin.__init__F s{
&01H&I&I&M&M '
'
#
. / / 3 3I > >
10
7; 26 c
K d S N )r) loops r* create_sinkz!ImunifySecurityPlugin.create_sinkS s r, c K || _ || _ | j | | _ t
r | d {V d S t d d S )NT)
missing_ok) r r! create_taskrefresh_auth_files_update_auth_taskr _apply_first_install_configFIRST_INSTALL_FLAGunlink)r) r0 sinks r*
create_sourcez#ImunifySecurityPlugin.create_sourceV s
!%!7!7 # # % %"
"
72244 4 4 4 4 4 4 4 4 4 % % % 6 6 6 6 6r, c f K t sd S t j d {V dk rKt
t }t
d t
d S )N i ) r8 existsr HostingPanel users_countFIRST_INSTALL_CONFIG_PATH
write_textFIRST_INSTALL_CONFIG_FILE read_textchmodr9 )r) _s r* r7 z1ImunifySecurityPlugin._apply_first_install_configa s !((** F +--99;; ; ; ; ; ; ;q @ @)44)3355 A
& + +E 2 2 2!!#####r, c V K | j | j d {V d S r. )r6 cancelr( s r* shutdownz ImunifySecurityPlugin.shutdownk s< %%'''$$$$$$$$$$r, c t | | st d| t | | }|d uo)| o| S )NzUnknown task '%s')hasattrloggererrorgetattrdone cancelled)r) task_attr_nametasks r* _task_in_progressz'ImunifySecurityPlugin._task_in_progressp sd t^,, > LL,n = = =t^,,4 L OLDNN|
t
j | j d {V d| _ d S d S d S ) Nz 3 3 3.
++)tz::: " ,
^ 0
0
0*
;;; ; ; ; ; ; ; ; ; ;
^y
(
(1tzBBB B B B B B B B 4
4++/TZ@@@ /4+++ )
(
4
4r, c K t |d t sd S t j }|| j k rd S || _ |rB| j s;| t j | j d {V d| _ nC|sA| j r:|
t j | j d {V d| _ t d| j |d d S )Nconfrc TFr )r r )
isinstancer r r$ r% r# rY r ri r! r[ rl r
)r) rm current_config_values r* manage_plugin_installationz0ImunifySecurityPlugin.manage_plugin_installation sF '&/<88 F ( @ 4#9 9 9 F "6 0(C 0++)tz:::
+/D ' '% 0$*E 0''+<<<
+0D ' # ! 8/
r, c $ K | j sdS | d dk s| d sdS t j |d }t }|D ]}|j dk r t
j |j }t j
| }|r|j nd}|D ]5}|j
| r| ||f n6# t $ r Y w xY w|s t d dS t dt' | d |D } t j | j | d{V t d t' | dS )
a
INFO [2025-02-24 12:00:20,384] imav.plugins.wordpress: Malware cleanup finished:
HookEvent.MalwareCleanupFinished(
{
'cleanup_id': 'fa4fe7e48dbf45588f53b24366cd8893',
'started': 1740398411.786418,
'error': None,
'total_files': 3,
'total_cleaned': 3,
'status': 'ok'
}
)
Nstatusokstartedfilez3Cleanup finished => no sites found for cleaned hitsz1Cleanup finished => %s site(s) need to be updatedc 8 g | ]\ }}t |d | S ) )docrootdomainuidr ).0 site_pathr} s r*
zIImunifySecurityPlugin.handle_malware_cleanup_finished.. s;
3
9RS 9 9 9
r, z"%s site(s) updated after a cleanup)r% r" r
cleaned_sinceset
resource_typepwdgetpwnamuserr get_sites_for_userpw_uid orig_file
startswithaddKeyErrorrL debugrf lenupdate_data_on_sitesr! )
r) rm hits
site_pathshit user_info
user_sitesr} r wordpress_sitess
r* handle_malware_cleanup_finishedz5ImunifySecurityPlugin.handle_malware_cleanup_finished s % F ;;x D ( ( I0F0F ( F ' (:;;UU
C F** # SX 6 6I!'!:9!E!EJ,5? ((4 &0 " " =33I>> " &NNIs+; < < < !E" D + LLN O O O F ?
OO
",
)$*oFFFFFFFFF 8#o:N:NOOOOOs 4A0C%%
C21C2c K | j sdS | d dk s*| d r| d sdS |d }t | }|s t d| dS t dt
| t j | j | d{V t dt
| dS ) a
INFO [2025-02-24 11:57:17,968] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'b9bd136aff0a4d87a248c859cfe41c47',
'scan_type': 'user',
'path': '/home/user1'
}
)
INFO [2025-02-24 12:00:10,740] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'a74271d2cdd04e0c9bd49ef6de23e0d8',
'scan_type': 'user',
'path': '/home/user4',
'started': 1740398383,
'total_files': 39229,
'total_malicious': 3,
'error': None,
'status': 'ok',
'scan_params': {'intensity_cpu': 2, 'intensity_io': 2, 'intensity_ram': 2048, 'initiator': None, 'file_patterns': None, 'exclude_patterns': None, 'follow_symlinks': False, 'detect_elf': True},
'stats': {'scan_time': 27, 'mem_peak': 28217344, 'smart_time_hs': 0.004, 'scan_time_hs': 1.1751, 'smart_time_preg': 0, 'scan_time_preg': 2.7391, 'finder_time': 13.5896, 'cas_time': 0.7562, 'deobfuscate_time': 0.8998, 'total_files': 39229}
}
)
Nru rv pathstatsz+Scan finished => no sites found for path=%sz.Scan finished => %s site(s) need to be updatedz %s site(s) updated after a scan)
r% r" r rL r rf r r r r! )r) rm r sitess r* handle_malware_scan_finishedz2ImunifySecurityPlugin.handle_malware_scan_finished s 8 % F
KK ! !T ) );;v&&
*;;w''
*
F v!$'' LLF M M M F P >P .->P@ VI -..4C 4C /.4C 4C 4Cr, r )5__doc__loggingr rV pathlibr %defence360agent.contracts.hook_eventsr defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r
defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater r
r defence360agent.utilsr r defence360agent.utils.check_lockr defence360agent.utils.commonr imav.wordpressr imav.contracts.configr imav.malwarelib.modelr imav.model.wordpressr imav.wordpress.site_repositoryr imav.wordpress.proxy_authr r getLoggerr rL r r
CONFIG_DIRrC rA r8 r r/ r, r* r sS *
; ; ; ; ; ; I I I I I I I I : : : : : :
8 7 7 7 7 7
9 8 8 8 8 8 8 8 7 7 7 7 7 7 , , , , , , ! ! ! ! ! ! + + + + + + , , , , , , ' ' ' ' ' ' < < < < < < F F F F F F F F
8 $ $ }en = =
TA
B
B
DL ')K K "CC QC QC QC QC QCK QC QC QC QC QCr,