🛡️ V29: OMNIPOTENT SURGEON 🛡️

#!/bin/bash
# ==================================================
# V29: OMNIPOTENT SURGEON
# Mengantisipasi Semua Skenario Terburuk & Mutasi Malware
# ==================================================

echo "🔥 MENGINISIASI V29 (OMNIPOTENT SURGEON) 🔥"
echo "=================================================="

WCMD="wp"
if [ -f "/var/softaculous/wp/wp-cli" ]; then
  WCMD="php /var/softaculous/wp/wp-cli"
fi

nuke() {
  T="$1"
  R="$2"
  echo "   [!] DETEKSI: $R"
  echo "       ↳ File: $T"
  FN=$(basename "$T")
  case "$FN" in
    functions.php|header.php|index.php|wp-config.php|footer.php)
      echo "       [🛡️ PROTECTED] File Core Tema/WP."
      ;;
    *)
      chattr -i "$T" 2>/dev/null
      chmod 777 "$T" 2>/dev/null
      rm -f "$T" 2>/dev/null || > "$T"
      echo "       [☠️ KILLED] File malware dimusnahkan."
      DIR=$(dirname "$T")
      find "$DIR" -maxdepth 1 -name "index.php" \
        -size -200c -delete 2>/dev/null
      if [ -d "$DIR" ] && [ -z "$(ls -A "$DIR" 2>/dev/null)" ]; then
        rm -rf "$DIR" 2>/dev/null
        echo "       [🗑️ CLEANUP] Folder kosong dihapus."
      fi
      ;;
  esac
  echo "   ------------------------------------------------"
}

SAVEIFS=$IFS
IFS=$'\n'

for CFG in $(find "$(pwd)" -type f -name "wp-config.php" 2>/dev/null); do
  WDIR=$(dirname "$CFG")
  WCON="$WDIR/wp-content"
  echo "[*] TARGET: $WDIR"

  chattr -R -i "$WDIR" 2>/dev/null
  find "$WDIR" -type d -exec chmod 755 {} + 2>/dev/null
  find "$WDIR" -type f -exec chmod 644 {} + 2>/dev/null

  echo " -> [1/6] Membasmi Folder Zombi Tersembunyi..."
  find "$WCON" -maxdepth 1 -type d -name ".sc_*" -exec rm -rf {} + 2>/dev/null
  rm -rf "$WCON/mu-plugins" 2>/dev/null
  echo "       [☠️ KILLED] Sarang .sc_* dan mu-plugins rata dengan tanah."

  echo " -> [2/6] Membedah Tema & Core (Menangkap SCOCV)..."
  BP="$WDIR/.bdh.php"
  echo '<?php' > "$BP"
  echo '$f = $argv[1];' >> "$BP"
  echo 'if(file_exists($f)){' >> "$BP"
  echo ' $c = file_get_contents($f); $o = $c; $n = 0;' >> "$BP"
  echo ' $p1 = "/\/\*\s*(\.wp-[a-z-]+|SC_[A-Z_]+BEGIN|SCOCV:).*?\*\/\s*/s";' >> "$BP"
  echo ' $p1 = substr($p1, 0, -2);' >> "$BP"
  echo ' $p2 = ".*?\/\*\s*SC_[A-Z_]+END:.*?\*\/\s*/s";' >> "$BP"
  echo ' $r = $p1 . $p2;' >> "$BP"
  echo ' $cln = preg_replace($r, "", $c, -1, $n);' >> "$BP"
  echo ' if($n > 0){ file_put_contents($f, $cln); echo "OK"; }' >> "$BP"
  echo '}' >> "$BP"

  STMP="$WDIR/.scn.tmp"
  CMD="find $WDIR -type f -name *.php"
  R_SC="SC_[A-Z_]+BEGIN|SCOCV:"
  $CMD -exec grep -lE "$R_SC" {} + > "$STMP" 2>/dev/null

  while IFS= read -r inf; do
    if [ -n "$inf" ] && [ -f "$inf" ]; then
      echo "   [!] Injeksi Parasit Malware di $inf"
      RES=$(php "$BP" "$inf" 2>/dev/null)
      if [[ "$RES" == *"OK"* ]]; then
        echo "       [✨ SUCCESS] Kode parasit berhasil dipotong!"
      else
        echo "       [⚠️ WARNING] Gagal membedah via PHP."
      fi
    fi
  done < "$STMP"
  rm -f "$BP" "$STMP" 2>/dev/null

  echo " -> [3/6] Hancurkan Cron Malware..."
  PFX=$(grep "\$table_prefix" "$CFG" | cut -d "'" -f 2 | head -n 1)
  if [ -n "$PFX" ]; then
    DBN=$(grep -E "define\s*\(\s*'DB_NAME'" "$CFG" | cut -d "'" -f 4)
    DBU=$(grep -E "define\s*\(\s*'DB_USER'" "$CFG" | cut -d "'" -f 4)
    DBP=$(grep -E "define\s*\(\s*'DB_PASSWORD'" "$CFG" | cut -d "'" -f 4)
    DBH=$(grep -E "define\s*\(\s*'DB_HOST'" "$CFG" | cut -d "'" -f 4)

    if command -v $WCMD &> /dev/null; then
      CTMP="$WDIR/.crn.tmp"
      ARGS="cron event list --fields=hook --format=csv"
      $WCMD $ARGS --path="$WDIR" > "$CTMP" 2>/dev/null
      
      while IFS= read -r hk; do
        if echo "$hk" | grep -qE "^[a-z0-9]{12,40}$"; then
          echo "   [!] CRON MALWARE: '$hk'"
          CMD2="find $WCON -type f -name *.php"
          $CMD2 -exec grep -l "$hk" {} + > "$STMP" 2>/dev/null
          while IFS= read -r inf; do
            [ -n "$inf" ] && nuke "$inf" "Cron Hook ($hk)"
          done < "$STMP"
          $WCMD cron event delete "$hk" --path="$WDIR" 2>/dev/null
        fi
      done < "$CTMP"
      rm -f "$CTMP" "$STMP" 2>/dev/null
      QRY="DELETE FROM ${PFX}options WHERE option_name='cron'"
      $WCMD db query "$QRY" --path="$WDIR" 2>/dev/null
    fi
    
    QRY2="DELETE FROM ${PFX}options WHERE option_name='cron';"
    MYSQL_PWD="$DBP" mysql -u"$DBU" -h"$DBH" "$DBN" -e "$QRY2" 2>/dev/null
  fi

  echo " -> [4/6] Memburu Offline Brains (Heuristik)..."
  P1="$WCON/plugins"
  P2="$WCON/themes"
  CMD3="find $P1 $P2 -type f -name *.php"

  F_ARG='static $a=null;if($a===null){$a=array'
  $CMD3 -exec grep -lF "$F_ARG" {} + > "$STMP" 2>/dev/null
  while IFS= read -r inf; do
    [ -n "$inf" ] && nuke "$inf" "APT Builder Forge"
  done < "$STMP"

  E_ARG='eval[[:space:]]*\([[:space:]]*(base64_decode|gzinflate)'
  $CMD3 -exec grep -lE "$E_ARG" {} + > "$STMP" 2>/dev/null
  while IFS= read -r inf; do
    [ -n "$inf" ] && nuke "$inf" "Eval Backdoor"
  done < "$STMP"

  R1="wp_schedule_event[[:space:]]*\([^,]+,[[:space:]]*"
  R2="['\"][a-zA-Z0-9_]+['\"],[[:space:]]*['\"][a-z0-9]{12,40}['\"]"
  $CMD3 -exec grep -lE "$R1$R2" {} + > "$STMP" 2>/dev/null
  while IFS= read -r inf; do
    [ -n "$inf" ] && nuke "$inf" "Stealth Cron Injector"
  done < "$STMP"
  
  rm -f "$STMP" 2>/dev/null

  echo " -> [5/6] Membasmi Cache Drop-in Palsu..."
  rm -f "$WDIR/.user.ini" "$WDIR/php.ini" 2>/dev/null
  rm -f "$WCON/.user.ini" "$WCON/php.ini" 2>/dev/null
  find "$WCON" -maxdepth 1 -type f -name ".*" ! -name ".htaccess" \
    -exec rm -f {} + 2>/dev/null
  
  find "$WCON" -maxdepth 1 -type f -name "*.php" > "$STMP" 2>/dev/null
  while IFS= read -r f; do
    fn=$(basename "$f")
    case "$fn" in
      index.php)
        ;;
      *)
        rm -f "$f" 2>/dev/null || > "$f"
        echo "   [☠️ KILLED] Cache/Drop-in: $f"
        ;;
    esac
  done < "$STMP"
  rm -f "$STMP" 2>/dev/null

  find "$WCON" -maxdepth 1 -type f -name "*.zip" -delete 2>/dev/null
  [ -d "$WCON/uploads" ] && find "$WCON/uploads" -type f -name "*.php" \
    -delete 2>/dev/null

  echo " -> [6/6] Normalisasi Mutlak .htaccess..."
  HT="$WDIR/.htaccess"
  chattr -i "$HT" 2>/dev/null
  
  echo "# BEGIN WordPress" > "$HT"
  echo "<IfModule mod_rewrite.c>" >> "$HT"
  echo "RewriteEngine On" >> "$HT"
  echo "RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]" >> "$HT"
  echo "RewriteBase /" >> "$HT"
  echo "RewriteRule ^index\.php$ - [L]" >> "$HT"
  echo "RewriteCond %{REQUEST_FILENAME} !-f" >> "$HT"
  echo "RewriteCond %{REQUEST_FILENAME} !-d" >> "$HT"
  echo "RewriteRule . /index.php [L]" >> "$HT"
  echo "</IfModule>" >> "$HT"
  echo "# END WordPress" >> "$HT"
  chmod 644 "$HT" 2>/dev/null
  echo "       [✨ SUCCESS] .htaccess di-reset ke standar WordPress."

  echo " [✔] Seluruh Skema Kiamat telah dieksekusi."
  echo " =================================================="
done

IFS=$SAVEIFS
echo "🎉 OMNIPOTENT SURGEON SELESAI. ANDA MENANG."