import os, sys

target_roots = [
    "/home2/newspike",
    "/home2/knsign",
    "/home2/ulsanih",
    "/home2/corea-market",
    "/home2/rsc",
    "/home2/sklo2",
    "/home2/cfbt",
    "/home2/coexist",
    "/home2/gdm",
    "/home2/nanunbom",
    "/home2/pixelft"
]

wp_standard_files = {
    'index.php', 'wp-config.php', 'wp-load.php', 'wp-settings.php', 'wp-blog-header.php',
    'wp-cron.php', 'wp-login.php', 'wp-comments-post.php', 'wp-mail.php', 'wp-signup.php',
    'wp-trackback.php', 'xmlrpc.php', 'wp-activate.php', 'wp-links-opml.php', 'wp-config-sample.php',
    'wordfence-waf.php', 'readme.html', 'license.txt', 'robots.txt'
}

gnu_standard_files = {
    'index.php', 'common.php', 'config.php', 'head.php', 'tail.php', 'head.sub.php', 'tail.sub.php',
    '_common.php', '_head.php', '_tail.php', 'dbconfig.php'
}

# Malicious drop files located directly in web root
known_root_malware_files = {
    'ammika.php', 'saiga.php', 'bind.php', 'comp.php', 'component.php', 'converter.php',
    'defaults.php', 'drum.php', 'elem.php', 'ent.php', 'entity.php', 'forms.php', 'get.php',
    'goods.php', 'legacy.php', 'main.php', 'plugins.php', 'product.php', 'qp09X.php',
    'retries.php', 'short.php', 'srtain.php', 'style.php', 'user.php', 'index.php0',
    'wp-loginizer.php', 'wp-images.php', 'check_snippets.php', 'wp-conffq.php',
    '2ops.php', 'about.php'
}

known_root_malware_dotfiles = {
    '.factor', '.pset', '.res', '.binding', '.k', '.bind', '.comp', '.component', '.dat',
    '.data', '.dchunk', '.desc', '.descriptor', '.elem', '.element', '.ent', '.entity',
    '.entry', '.fac', '.flag', '.flg', '.hld', '.holder', '.item', '.itm', '.key',
    '.marker', '.mrk', '.obj', '.object', '.parameter_group', '.pointer', '.property_set',
    '.ptr', '.rec', '.record', '.ref', '.reference', '.resource', '.sym', '.symbol',
    '.tkn', '.token', '.val', '.value'
}

print("=== 2단계: 악성 웹셸 및 드롭 파일 안전 삭제 (플러그인/테마 보존) ===")

total_deleted = 0

for r in target_roots:
    if not os.path.isdir(r):
        continue
    print(f"\n--- 루트 점검: {r} ---")
    
    # 1. Root level scan ONLY (Direct children of root folder)
    for f in os.listdir(r):
        fp = os.path.join(r, f)
        
        # NEVER touch directories (e.g. wp-content, wp-admin, wp-includes, plugins, themes)
        if os.path.isdir(fp):
            continue
            
        is_malware = False
        reason = ""
        
        if f in known_root_malware_dotfiles or f in known_root_malware_files:
            is_malware = True
            reason = "루트 악성 드롭 파일"
        elif f.endswith('.php0') or f.endswith('.accept02.php'):
            is_malware = True
            reason = "변조된 백도어 PHP 파일"
        elif f.startswith('Filesystem.') or f.startswith('HMAC.') or f.startswith('Market.') or f.startswith('SASL.') or f.startswith('Smarty.') or f.startswith('V3.') or f.startswith('adaptive.') or f.startswith('adminmenu.') or f.startswith('ebank.') or f.startswith('formtextarea.') or f.startswith('haskell.') or f.startswith('topextensions.'):
            is_malware = True
            reason = "인젝션된 난독화 클래스 웹셸 파일"
        elif f.endswith('.php') and f not in wp_standard_files and f not in gnu_standard_files:
            try:
                with open(fp, 'r', errors='ignore') as file_obj:
                    content = file_obj.read(4096)
                    if 'eval(' in content or 'base64_decode' in content or 'gzuncompress' in content or '$$' in content:
                        is_malware = True
                        reason = "루트 내 난독화 실행 코드 포함 의심 PHP 파일"
            except:
                pass
                
        if is_malware:
            try:
                os.remove(fp)
                print(f"  [삭제 완료] {f} ({reason})")
                total_deleted += 1
            except Exception as e:
                print(f"  [삭제 실패] {f}: {e}")

    # 2. Uploads folder scan ONLY (wp-content/uploads/ contains NO plugins or valid php scripts)
    uploads_dir = os.path.join(r, "wp-content", "uploads")
    if os.path.exists(uploads_dir):
        for root, dirs, files in os.walk(uploads_dir):
            for f in files:
                if f.endswith('.php') or f.endswith('.php0') or f.endswith('.ico') or f.endswith('.png'):
                    fp = os.path.join(root, f)
                    try:
                        with open(fp, 'r', errors='ignore') as file_obj:
                            content = file_obj.read(4096)
                            if f.endswith('.php') or 'eval(' in content or '<?php' in content or 'base64_decode' in content:
                                os.remove(fp)
                                print(f"  [Uploads 폴더 비정상 PHP 삭제] {os.path.relpath(fp, r)}")
                                total_deleted += 1
                    except Exception as e:
                        pass

print(f"\n=== 2단계 완료: 총 {total_deleted}개의 웹셸 및 백도어 드롭 파일을 안전하게 삭제했습니다 ===")