<?php
/**
 * WordPress Malware Cleaner - Web Interface
 * 
 * SECURITY: Change the password below before using!
 * Access: http://yoursite.com/malware-cleaner.php
 * 
 * ⚠️ DELETE THIS FILE after cleanup is complete!
 */

// ============================================
// CONFIGURATION - CHANGE THIS PASSWORD!
// ============================================
define('CLEANUP_PASSWORD', 'ChangeMe123!');  // ⚠️ CHANGE THIS!
define('BASE_PATH', __DIR__ . '/wp-content');
define('LOG_FILE', __DIR__ . '/malware-cleanup-' . date('Y-m-d-His') . '.log');

// ============================================
// AUTHENTICATION
// ============================================
session_start();

if (isset($_POST['logout'])) {
    unset($_SESSION['authenticated']);
    session_destroy();
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

if (isset($_POST['password'])) {
    if ($_POST['password'] === CLEANUP_PASSWORD) {
        $_SESSION['authenticated'] = true;
    } else {
        $error = "Invalid password!";
    }
}

if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
    showLoginForm($error ?? '');
    exit;
}

// ============================================
// MALWARE SCANNER CLASS
// ============================================
class MalwareCleaner {
    private $deletedCount = 0;
    private $scannedCount = 0;
    private $results = [];
    private $logFile;
    
    public function __construct($logFile) {
        $this->logFile = $logFile;
    }
    
    public function scan($execute = false) {
        $this->log("=== Malware Scan Started ===");
        $this->log("Mode: " . ($execute ? "DELETE" : "SCAN ONLY"));
        $this->log("Time: " . date('Y-m-d H:i:s'));
        
        // Run all scan patterns
        $this->scanUploadsForPhp($execute);
        $this->scanEvalBase64($execute);
        $this->scanCookieBackdoors($execute);
        $this->scanMaliciousCacheFiles($execute);
        $this->scanHexEncoded($execute);
        $this->scanWordPressScanners($execute);
        $this->scanFileUploadBackdoors($execute);
        $this->scanObfuscated($execute);
        $this->scanKnownMalwareNames($execute);
        $this->scanMaliciousTxtFiles($execute);
        
        $this->log("=== Scan Completed ===");
        $this->log("Files scanned: " . $this->scannedCount);
        $this->log("Files deleted: " . $this->deletedCount);
        
        return [
            'scanned' => $this->scannedCount,
            'deleted' => $this->deletedCount,
            'results' => $this->results
        ];
    }
    
    private function scanUploadsForPhp($execute) {
        $this->addResult("Scanning uploads directory for PHP files...");
        $uploadsDir = BASE_PATH . '/uploads';
        if (!is_dir($uploadsDir)) return;
        
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($uploadsDir, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile() && $file->getExtension() === 'php') {
                $this->scannedCount++;
                $this->flagFile($file->getPathname(), "PHP file in uploads directory", $execute);
            }
        }
    }
    
    private function scanEvalBase64($execute) {
        $this->addResult("Scanning for eval/base64_decode malware...");
        $patterns = [
            '/eval\s*\(\s*base64_decode/',
            '/@eval\s*\(/',
            '/gzinflate\s*\(\s*base64_decode/'
        ];
        
        $this->scanByPattern($patterns, BASE_PATH, $execute, "Eval/Base64 malware");
    }
    
    private function scanCookieBackdoors($execute) {
        $this->addResult("Scanning for cookie-based backdoors...");
        $patterns = [
            '/isset\s*\(\s*\$_COOKIE.*base64_decode.*str_rot13/',
            '/tempnam\s*\(.*session_save_path.*base64_decode/'
        ];
        
        $this->scanByPattern($patterns, BASE_PATH . '/plugins', $execute, "Cookie backdoor");
    }
    
    private function scanMaliciousCacheFiles($execute) {
        $this->addResult("Scanning for malicious cache.php files...");
        $this->scanByFilenameAndContent('cache.php', '/error_reporting\(0\).*\\\\x[0-9a-f]{2}/', $execute, "Malicious cache.php");
        $this->scanByFilenameAndContent('index.php', '/error_reporting\(0\).*\\\\x[0-9a-f]{2}.*zip:\/\//', $execute, "Malicious index.php");
    }
    
    private function scanHexEncoded($execute) {
        $this->addResult("Scanning for hex-encoded malware...");
        $patterns = [
            '/\\\\x[0-9a-f]{2}.*\\\\x[0-9a-f]{2}.*\\\\x[0-9a-f]{2}.*eval/',
            '/\\\\x70\\\\x68\\\\x70.*eval/'
        ];
        
        $this->scanByPattern($patterns, BASE_PATH . '/plugins', $execute, "Hex-encoded malware", ['codemirror', 'ace-editor', 'tinymce']);
    }
    
    private function scanWordPressScanners($execute) {
        $this->addResult("Scanning for WordPress scanners...");
        $patterns = [
            '/WordPress.*Scanner/',
            '/Login.*Parser.*Worker/',
            '/checkWordPressAdmin/',
            '/tryDirectRestAPI/'
        ];
        
        $this->scanByPattern($patterns, BASE_PATH, $execute, "WordPress scanner", ['wp-includes']);
    }
    
    private function scanFileUploadBackdoors($execute) {
        $this->addResult("Scanning for file upload backdoors...");
        $this->scanByPattern(
            ['/@eval.*\$_(REQUEST|POST|GET)/'],
            BASE_PATH . '/plugins',
            $execute,
            "File upload backdoor"
        );
    }
    
    private function scanObfuscated($execute) {
        $this->addResult("Scanning for obfuscated malware...");
        $patterns = [
            '/goto\s+[A-Za-z0-9_]{5,}.*metaphone/',
            '/goto.*INI3A/'
        ];
        
        $this->scanByPattern($patterns, BASE_PATH . '/themes', $execute, "Obfuscated malware");
    }
    
    private function scanKnownMalwareNames($execute) {
        $this->addResult("Scanning for known malware filenames...");
        $malwareNames = [
            'shopzilla.php', 'googlecart.php', 'virtuemart.php', 'shi.php',
            'bnf.php', 'slovenian.php', 'nggshow.php', 'aioseop.class.php',
            'sql3.php', 'db_links.inc.php', 'style.bak.php', 'composerjm.php',
            'rowj.php', 'imagers.php', 'm_closed.php', 'vdvlf.php',
            'shsef.php', 'div.php', 'secure.php', 'lay.post.php'
        ];
        
        foreach ($malwareNames as $name) {
            $this->scanByFilename($name, BASE_PATH, $execute, "Known malware: $name");
        }
    }
    
    private function scanMaliciousTxtFiles($execute) {
        $this->addResult("Scanning for malicious .txt files...");
        $this->scanByFilenameAndContent('*.txt', '/^<\?php/', $execute, "Malicious .txt file", BASE_PATH . '/plugins');
    }
    
    // Helper methods
    private function scanByPattern($patterns, $directory, $execute, $reason, $excludes = []) {
        if (!is_dir($directory)) return;
        
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($directory, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if (!$file->isFile()) continue;
            
            $path = $file->getPathname();
            
            // Skip excluded paths
            foreach ($excludes as $exclude) {
                if (strpos($path, $exclude) !== false) continue 2;
            }
            
            $this->scannedCount++;
            $content = @file_get_contents($path);
            
            if ($content === false) continue;
            
            foreach ($patterns as $pattern) {
                if (preg_match($pattern, $content)) {
                    $this->flagFile($path, $reason, $execute);
                    break;
                }
            }
        }
    }
    
    private function scanByFilename($filename, $directory, $execute, $reason) {
        if (!is_dir($directory)) return;
        
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($directory, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile() && $file->getFilename() === $filename) {
                $this->scannedCount++;
                $this->flagFile($file->getPathname(), $reason, $execute);
            }
        }
    }
    
    private function scanByFilenameAndContent($pattern, $contentPattern, $execute, $reason, $directory = null) {
        $directory = $directory ?? BASE_PATH;
        if (!is_dir($directory)) return;
        
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($directory, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if (!$file->isFile()) continue;
            
            $filename = $file->getFilename();
            if ($pattern === '*.txt') {
                if ($file->getExtension() !== 'txt') continue;
            } else {
                if ($filename !== $pattern) continue;
            }
            
            $this->scannedCount++;
            $content = @file_get_contents($file->getPathname());
            
            if ($content && preg_match($contentPattern, $content)) {
                $this->flagFile($file->getPathname(), $reason, $execute);
            }
        }
    }
    
    private function flagFile($path, $reason, $execute) {
        $relativePath = str_replace(__DIR__ . '/', '', $path);
        
        if ($execute) {
            if (@unlink($path)) {
                $this->deletedCount++;
                $this->addResult("✓ DELETED: $relativePath - $reason", 'danger');
                $this->log("DELETED: $path - $reason");
            } else {
                $this->addResult("✗ FAILED: $relativePath - $reason", 'warning');
                $this->log("FAILED TO DELETE: $path - $reason");
            }
        } else {
            $this->addResult("⚠ FOUND: $relativePath - $reason", 'warning');
            $this->log("FOUND: $path - $reason");
        }
    }
    
    private function addResult($message, $type = 'info') {
        $this->results[] = ['message' => $message, 'type' => $type];
    }
    
    private function log($message) {
        file_put_contents($this->logFile, date('Y-m-d H:i:s') . " - $message\n", FILE_APPEND);
    }
}

// ============================================
// PROCESS ACTIONS
// ============================================
$action = $_GET['action'] ?? '';
$results = null;

if ($action === 'scan' || $action === 'clean') {
    $cleaner = new MalwareCleaner(LOG_FILE);
    $results = $cleaner->scan($action === 'clean');
}

// ============================================
// HTML INTERFACE
// ============================================
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>WordPress Malware Cleaner</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            min-height: 100vh;
            padding: 20px;
        }
        .container {
            max-width: 1200px;
            margin: 0 auto;
            background: white;
            border-radius: 10px;
            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
            overflow: hidden;
        }
        .header {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white;
            padding: 30px;
            text-align: center;
        }
        .header h1 {
            font-size: 2.5em;
            margin-bottom: 10px;
        }
        .header p {
            opacity: 0.9;
            font-size: 1.1em;
        }
        .content {
            padding: 40px;
        }
        .warning-box {
            background: #fff3cd;
            border-left: 4px solid #ffc107;
            padding: 20px;
            margin-bottom: 30px;
            border-radius: 5px;
        }
        .warning-box h3 {
            color: #856404;
            margin-bottom: 10px;
        }
        .warning-box ul {
            margin-left: 20px;
            color: #856404;
        }
        .warning-box li {
            margin: 5px 0;
        }
        .button-group {
            display: flex;
            gap: 15px;
            margin-bottom: 30px;
            flex-wrap: wrap;
        }
        .btn {
            padding: 15px 30px;
            font-size: 16px;
            border: none;
            border-radius: 5px;
            cursor: pointer;
            text-decoration: none;
            display: inline-block;
            transition: all 0.3s;
            font-weight: 600;
        }
        .btn-primary {
            background: #007bff;
            color: white;
        }
        .btn-primary:hover {
            background: #0056b3;
            transform: translateY(-2px);
            box-shadow: 0 5px 15px rgba(0,123,255,0.3);
        }
        .btn-danger {
            background: #dc3545;
            color: white;
        }
        .btn-danger:hover {
            background: #c82333;
            transform: translateY(-2px);
            box-shadow: 0 5px 15px rgba(220,53,69,0.3);
        }
        .btn-secondary {
            background: #6c757d;
            color: white;
        }
        .btn-secondary:hover {
            background: #545b62;
        }
        .results {
            margin-top: 30px;
        }
        .result-item {
            padding: 12px 15px;
            margin: 8px 0;
            border-radius: 5px;
            border-left: 4px solid #ccc;
            background: #f8f9fa;
            font-family: 'Courier New', monospace;
            font-size: 14px;
        }
        .result-item.info {
            border-left-color: #17a2b8;
            background: #e7f7f9;
        }
        .result-item.warning {
            border-left-color: #ffc107;
            background: #fff9e6;
        }
        .result-item.danger {
            border-left-color: #dc3545;
            background: #ffe6e6;
        }
        .summary {
            background: #28a745;
            color: white;
            padding: 20px;
            border-radius: 5px;
            margin-bottom: 20px;
            text-align: center;
        }
        .summary h2 {
            margin-bottom: 10px;
        }
        .summary .stats {
            display: flex;
            justify-content: center;
            gap: 40px;
            margin-top: 15px;
        }
        .summary .stat {
            font-size: 1.2em;
        }
        .summary .stat strong {
            font-size: 2em;
            display: block;
        }
        .footer {
            background: #f8f9fa;
            padding: 20px;
            text-align: center;
            border-top: 1px solid #dee2e6;
        }
        .logout-form {
            display: inline;
        }
    </style>
</head>
<body>
    <div class="container">
        <div class="header">
            <h1>🛡️ WordPress Malware Cleaner</h1>
            <p>Automated malware detection and removal tool</p>
        </div>
        
        <div class="content">
            <div class="warning-box">
                <h3>⚠️ Important Instructions:</h3>
                <ul>
                    <li><strong>BACKUP</strong> your site before running cleanup!</li>
                    <li>First run a <strong>SCAN</strong> to see what will be deleted</li>
                    <li>Then run <strong>CLEAN</strong> to delete malware files</li>
                    <li><strong>DELETE THIS FILE</strong> after cleanup is complete!</li>
                    <li>Check the log file for detailed information</li>
                </ul>
            </div>
            
            <div class="button-group">
                <a href="?action=scan" class="btn btn-primary">🔍 Scan for Malware</a>
                <a href="?action=clean" class="btn btn-danger">🗑️ Clean Malware (Delete)</a>
                <form method="post" class="logout-form">
                    <button type="submit" name="logout" class="btn btn-secondary">🚪 Logout</button>
                </form>
            </div>
            
            <?php if ($results): ?>
                <div class="summary">
                    <h2><?php echo $action === 'clean' ? '✓ Cleanup Complete!' : '📊 Scan Results'; ?></h2>
                    <div class="stats">
                        <div class="stat">
                            <strong><?php echo $results['scanned']; ?></strong>
                            Files Scanned
                        </div>
                        <div class="stat">
                            <strong><?php echo $results['deleted']; ?></strong>
                            <?php echo $action === 'clean' ? 'Files Deleted' : 'Threats Found'; ?>
                        </div>
                    </div>
                </div>
                
                <div class="results">
                    <h3>Detailed Results:</h3>
                    <?php foreach ($results['results'] as $result): ?>
                        <div class="result-item <?php echo $result['type']; ?>">
                            <?php echo htmlspecialchars($result['message']); ?>
                        </div>
                    <?php endforeach; ?>
                </div>
                
                <div style="margin-top: 30px; padding: 20px; background: #e7f3ff; border-radius: 5px;">
                    <strong>📄 Log file created:</strong> <?php echo basename(LOG_FILE); ?>
                </div>
            <?php endif; ?>
        </div>
        
        <div class="footer">
            <p>WordPress Malware Cleaner v1.0 | <strong>Remember to delete this file after use!</strong></p>
        </div>
    </div>
</body>
</html>

<?php
// ============================================
// LOGIN FORM
// ============================================
function showLoginForm($error = '') {
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login - Malware Cleaner</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            min-height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 20px;
        }
        .login-box {
            background: white;
            padding: 40px;
            border-radius: 10px;
            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
            width: 100%;
            max-width: 400px;
        }
        .login-box h1 {
            text-align: center;
            margin-bottom: 30px;
            color: #333;
        }
        .form-group {
            margin-bottom: 20px;
        }
        .form-group label {
            display: block;
            margin-bottom: 8px;
            color: #555;
            font-weight: 600;
        }
        .form-group input {
            width: 100%;
            padding: 12px;
            border: 2px solid #ddd;
            border-radius: 5px;
            font-size: 16px;
            transition: border-color 0.3s;
        }
        .form-group input:focus {
            outline: none;
            border-color: #667eea;
        }
        .btn-login {
            width: 100%;
            padding: 15px;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white;
            border: none;
            border-radius: 5px;
            font-size: 16px;
            font-weight: 600;
            cursor: pointer;
            transition: transform 0.3s;
        }
        .btn-login:hover {
            transform: translateY(-2px);
        }
        .error {
            background: #f8d7da;
            color: #721c24;
            padding: 12px;
            border-radius: 5px;
            margin-bottom: 20px;
            border: 1px solid #f5c6cb;
        }
        .warning {
            background: #fff3cd;
            color: #856404;
            padding: 15px;
            border-radius: 5px;
            margin-top: 20px;
            border: 1px solid #ffeaa7;
            font-size: 14px;
        }
    </style>
</head>
<body>
    <div class="login-box">
        <h1>🔐 Malware Cleaner</h1>
        
        <?php if ($error): ?>
            <div class="error"><?php echo htmlspecialchars($error); ?></div>
        <?php endif; ?>
        
        <form method="post">
            <div class="form-group">
                <label for="password">Password:</label>
                <input type="password" id="password" name="password" required autofocus>
            </div>
            <button type="submit" class="btn-login">Login</button>
        </form>
        
        <div class="warning">
            <strong>⚠️ Security Notice:</strong><br>
            Change the password in this file before first use!<br>
            Delete this file after cleanup is complete.
        </div>
    </div>
</body>
</html>
<?php
    exit;
}
?>