^^&&^^

Edit File: limpiar_morinstudio.sh

#!/bin/bash
# ============================================================
#  Script de limpieza y reinstalación de WordPress
#  Sitio: morinstudio.com.mx
#  Servidor: pdx1-shared-a1-09.dreamhost.com (wdinamo)
#  Uso: bash limpiar_morinstudio.sh
# ============================================================

SITE_DIR="/home/wdinamo/morinstudio.com.mx"
WP_VERSION="6.7.2"   # Cambia si necesitas otra versión
BACKUP_DIR="/home/wdinamo/backups/morinstudio_$(date +%Y%m%d_%H%M%S)"
LOG="$BACKUP_DIR/limpieza.log"

echo "======================================================"
echo "  LIMPIEZA DE WORDPRESS - morinstudio.com.mx"
echo "  $(date)"
echo "======================================================"

# ----------------------------------------------------------
# 1. CREAR DIRECTORIO DE BACKUP
# ----------------------------------------------------------
echo ""
echo "[1/7] Creando backup de seguridad..."
mkdir -p "$BACKUP_DIR"

# Backup de wp-config.php
cp "$SITE_DIR/wp-config.php" "$BACKUP_DIR/wp-config.php.bak" 2>/dev/null
echo "  ✓ wp-config.php respaldado"

# Backup de wp-content (plugins, themes, uploads)
echo "  ⏳ Respaldando wp-content (puede tardar)..."
tar -czf "$BACKUP_DIR/wp-content.tar.gz" -C "$SITE_DIR" wp-content 2>/dev/null
echo "  ✓ wp-content respaldado en $BACKUP_DIR/wp-content.tar.gz"

# Backup de .htaccess
cp "$SITE_DIR/.htaccess" "$BACKUP_DIR/htaccess.bak" 2>/dev/null
echo "  ✓ .htaccess respaldado"

echo "" | tee -a "$LOG"
echo "  Backup completo en: $BACKUP_DIR" | tee -a "$LOG"

# ----------------------------------------------------------
# 2. ESCANEAR CÓDIGO OFUSCADO / MALWARE
# ----------------------------------------------------------
echo ""
echo "[2/7] Escaneando código sospechoso..." | tee -a "$LOG"

SCAN_REPORT="$BACKUP_DIR/scan_report.txt"
echo "=== REPORTE DE ESCANEO - $(date) ===" > "$SCAN_REPORT"

# Patrones maliciosos comunes
echo "" >> "$SCAN_REPORT"
echo "--- eval(base64_decode ---" >> "$SCAN_REPORT"
grep -rl "eval(base64_decode" "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- eval(\$_" >> "$SCAN_REPORT"
grep -rl 'eval(\$_' "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- base64_decode + str_rot13 (doble ofuscación) ---" >> "$SCAN_REPORT"
grep -rl "str_rot13" "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- gzinflate/gzuncompress (código comprimido) ---" >> "$SCAN_REPORT"
grep -rl "gzinflate\|gzuncompress\|gzdecode" "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- preg_replace con /e (ejecución de código) ---" >> "$SCAN_REPORT"
grep -rl "preg_replace.*\/e" "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- Shell backdoors (\$_POST exec / system) ---" >> "$SCAN_REPORT"
grep -rl '\$_POST\[.*\].*exec\|system\|passthru\|shell_exec' "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- assert(\$_" >> "$SCAN_REPORT"
grep -rl 'assert(\$_' "$SITE_DIR" --include="*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- Archivos PHP en wp-content/uploads (NO deberían existir) ---" >> "$SCAN_REPORT"
find "$SITE_DIR/wp-content/uploads" -name "*.php" 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- Archivos .php ocultos (nombre raro, solo hex) ---" >> "$SCAN_REPORT"
find "$SITE_DIR" -name "*.php" -not -path "*/wp-content/*" | grep -E '[0-9a-f]{8,}\.php' 2>/dev/null >> "$SCAN_REPORT"

echo "" >> "$SCAN_REPORT"
echo "--- Archivos modificados en las últimas 72 horas ---" >> "$SCAN_REPORT"
find "$SITE_DIR" -name "*.php" -newer "$SITE_DIR/wp-login.php" -mtime -3 2>/dev/null | head -50 >> "$SCAN_REPORT"

echo "  ✓ Reporte de escaneo guardado en: $SCAN_REPORT"
cat "$SCAN_REPORT" | tee -a "$LOG"

# ----------------------------------------------------------
# 3. ELIMINAR ARCHIVOS PHP INFECTADOS EN UPLOADS
# ----------------------------------------------------------
echo ""
echo "[3/7] Eliminando PHP malicioso en wp-content/uploads..." | tee -a "$LOG"

PHP_IN_UPLOADS=$(find "$SITE_DIR/wp-content/uploads" -name "*.php" 2>/dev/null)
if [ -n "$PHP_IN_UPLOADS" ]; then
    echo "$PHP_IN_UPLOADS" | while read f; do
        echo "  ELIMINANDO: $f" | tee -a "$LOG"
        # Mover a backup antes de eliminar
        cp "$f" "$BACKUP_DIR/$(basename $f).malware.bak" 2>/dev/null
        rm -f "$f"
    done
    echo "  ✓ Archivos PHP en uploads eliminados" | tee -a "$LOG"
else
    echo "  ✓ No se encontraron PHP en uploads" | tee -a "$LOG"
fi

# ----------------------------------------------------------
# 4. REINSTALAR CORE DE WORDPRESS (archivos del core solamente)
# ----------------------------------------------------------
echo ""
echo "[4/7] Reinstalando core de WordPress $WP_VERSION..." | tee -a "$LOG"

cd /tmp
echo "  ⏳ Descargando WordPress $WP_VERSION..."
curl -sO "https://wordpress.org/wordpress-${WP_VERSION}.tar.gz"

if [ ! -f "wordpress-${WP_VERSION}.tar.gz" ]; then
    echo "  ❌ ERROR: No se pudo descargar WordPress. Intenta manualmente:" | tee -a "$LOG"
    echo "     curl -O https://wordpress.org/wordpress-${WP_VERSION}.tar.gz" | tee -a "$LOG"
    exit 1
fi

echo "  ✓ WordPress descargado"
tar -xzf "wordpress-${WP_VERSION}.tar.gz"
echo "  ✓ WordPress descomprimido"

# Copiar solo archivos del core (NO wp-content, NO wp-config.php)
echo "  ⏳ Reemplazando archivos del core..."
rsync -a --exclude='wp-content' --exclude='wp-config.php' \
    /tmp/wordpress/ "$SITE_DIR/"

echo "  ✓ Core de WordPress reinstalado" | tee -a "$LOG"

# Limpiar descarga
rm -rf /tmp/wordpress /tmp/wordpress-${WP_VERSION}.tar.gz

# ----------------------------------------------------------
# 5. RESTAURAR wp-config.php Y LIMPIAR .HTACCESS
# ----------------------------------------------------------
echo ""
echo "[5/7] Verificando wp-config.php y .htaccess..." | tee -a "$LOG"

# Asegurar que wp-config.php sigue en su lugar
if [ ! -f "$SITE_DIR/wp-config.php" ]; then
    cp "$BACKUP_DIR/wp-config.php.bak" "$SITE_DIR/wp-config.php"
    echo "  ✓ wp-config.php restaurado desde backup" | tee -a "$LOG"
else
    echo "  ✓ wp-config.php intacto" | tee -a "$LOG"
fi

# Verificar .htaccess - debe tener solo el bloque estándar de WordPress
WP_HTACCESS="# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress"

# ----------------------------------------------------------
# 6. FIJAR PERMISOS CORRECTOS
# ----------------------------------------------------------
echo ""
echo "[6/7] Corrigiendo permisos..." | tee -a "$LOG"

find "$SITE_DIR" -type d -exec chmod 755 {} \; 2>/dev/null
find "$SITE_DIR" -type f -exec chmod 644 {} \; 2>/dev/null
chmod 600 "$SITE_DIR/wp-config.php" 2>/dev/null
echo "  ✓ Permisos: directorios 755, archivos 644, wp-config 600" | tee -a "$LOG"

# ----------------------------------------------------------
# 7. VERIFICACIÓN FINAL
# ----------------------------------------------------------
echo ""
echo "[7/7] Verificación final..." | tee -a "$LOG"

# Contar archivos PHP sospechosos restantes
REMAINING=$(grep -rl "eval(base64_decode\|gzinflate\|str_rot13" "$SITE_DIR" --include="*.php" 2>/dev/null | wc -l)
echo "  Archivos con patrones sospechosos restantes: $REMAINING" | tee -a "$LOG"

if [ "$REMAINING" -eq 0 ]; then
    echo "  ✅ ¡LIMPIO! No se detectaron patrones maliciosos en el core." | tee -a "$LOG"
else
    echo "  ⚠️  Aún hay archivos sospechosos en wp-content (plugins/themes infectados)." | tee -a "$LOG"
    echo "  Revisar manualmente o reinstalar plugins/themes sospechosos." | tee -a "$LOG"
    grep -rl "eval(base64_decode\|gzinflate\|str_rot13" "$SITE_DIR" --include="*.php" 2>/dev/null | tee -a "$LOG"
fi

echo ""
echo "======================================================"
echo "  PROCESO COMPLETADO"
echo "  Backup en:  $BACKUP_DIR"
echo "  Log en:     $LOG"
echo "  Reporte:    $SCAN_REPORT"
echo "======================================================"
echo ""
echo "PRÓXIMOS PASOS RECOMENDADOS:"
echo "  1. Cambiar contraseña de admin de WordPress"
echo "  2. Cambiar claves secretas en wp-config.php:"
echo "     https://api.wordpress.org/secret-key/1.1/salt/"
echo "  3. Actualizar todos los plugins y themes"
echo "  4. Instalar plugin de seguridad (Wordfence o iThemes Security)"
echo "  5. Cambiar contraseña de la base de datos"