cpanel 偵測腳本尋找入侵指標，並檢查檔案系統中的會話。

woff

ioc_checksessions_files.sh

1. #!/bin/bash
   
2. # Scan for compromised cPanel/WHM session files.
   
3. #
   
4. # Each check function inspects a single session file and, if the IOC
   
5. # matches, calls report_finding with a severity. report_finding records
   
6. # the finding, prints a one-line header, and dumps the session for triage.
   
7. # A summary of all findings (grouped by severity) is printed at the end.
   
8. 
   
9. 
   
10. # Default paths
    
11. SESSIONS_DIR="/var/cpanel/sessions"
    
12. ACCESS_LOG="/usr/local/cpanel/logs/access_log"
    
13. 
    
14. # Flags
    
15. VERBOSE=0
    
16. PURGE=0
    
17. ASSUME_YES=0
    
18. 
    
19. # Parse flags
    
20. while [ $# -gt 0 ]; do
    
21.     case "$1" in
    
22.         --verbose)
    
23.             VERBOSE=1
    
24.             ;;
    
25.         --purge)
    
26.             PURGE=1
    
27.             ;;
    
28.         --yes|-y)
    
29.             ASSUME_YES=1
    
30.             ;;
    
31.         --sessions-dir)
    
32.             SESSIONS_DIR="$2"; shift
    
33.             ;;
    
34.         --access-log)
    
35.             ACCESS_LOG="$2"; shift
    
36.             ;;
    
37.         --help|-h)
    
38.             echo "Usage: $0 [--verbose] [--purge [--yes]] [--sessions-dir DIR] [--access-log FILE]"
    
39.             exit 0
    
40.             ;;
    
41.         *)
    
42.             echo "Unknown argument: $1" >&2
    
43.             exit 1
    
44.             ;;
    
45.     esac
    
46.     shift
    
47. done
    
48. 
    
49. # Findings accumulator. Each entry: "SEVERITY|session_file|short_message"
    
50. FINDINGS=()
    
51. # Ordered list of unique session files that produced findings.
    
52. FINDING_SESSIONS=()
    
53. # Parallel array: token value associated with each entry in FINDING_SESSIONS
    
54. # (first non-empty token seen for that session).
    
55. FINDING_TOKENS=()
    
56. # Parallel array: highest severity reported for each session (by index)
    
57. FINDING_SEVERITIES=()
    
58. COUNT_CRITICAL=0
    
59. COUNT_WARNING=0
    
60. COUNT_INFO=0
    
61. COUNT_ATTEMPT=0
    
62. 
    
63. # ---------------------------------------------------------------------------
    
64. # Helpers
    
65. # ---------------------------------------------------------------------------
    
66. 
    
67. # Extract the value of a key=value line from a session file (first match).
    
68. # Use: get_field <file> <key>
    
69. get_field() {
    
70.     local file="$1" key="$2"
    
71.     grep "^${key}=" "$file" | head -1 | cut -d= -f2-
    
72. }
    
73. 
    
74. hr() {
    
75.     echo "    ----------------------------------------------------------------"
    
76. }
    
77. 
    
78. # Dump full contents of a session file plus related context (matching
    
79. # pre-auth file, access_log hits for the injected token, file metadata).
    
80. # Use: dump_session <session_file> [token_value]
    
81. dump_session() {
    
82.     local session_file="$1"
    
83.     local token_val="$2"
    
84.     local session_name preauth_file
    
85.     session_name=$(basename "$session_file")
    
86.     preauth_file="$SESSIONS_DIR/preauth/$session_name"
    
87. 
    
88.     hr
    
89.     echo "    SESSION DUMP: $session_file"
    
90.     hr
    
91.     echo "    File metadata:"
    
92.     ls -la "$session_file" 2>/dev/null | sed 's/^/      /'
    
93.     echo
    
94.     echo "    Full session contents:"
    
95.     sed 's/^/      /' "$session_file"
    
96.     echo
    
97. 
    
98.     if [ -f "$preauth_file" ]; then
    
99.         echo "    Matching pre-auth file: $preauth_file"
    
100.         ls -la "$preauth_file" 2>/dev/null | sed 's/^/      /'
     
101.         echo "    Pre-auth contents:"
     
102.         sed 's/^/      /' "$preauth_file"
     
103.         echo
     
104.     fi
     
105. 
     
106.     if [ -n "$token_val" ] && [ -r "$ACCESS_LOG" ]; then
     
107.         echo "    Access log hits for token '$token_val':"
     
108.         grep -aF -- "$token_val" "$ACCESS_LOG" | sed 's/^/      /' || echo "      (none)"
     
109.         echo
     
110.     fi
     
111.     hr
     
112. }
     
113. 
     
114. # Record a finding and print a brief header line. The full session dump is
     
115. # deferred to print_summary so that multiple findings for the same session
     
116. # are grouped together and the session is only dumped once. When the same
     
117. # session matches multiple IOCs at different severities, only the highest
     
118. # (CRITICAL > WARNING > ATTEMPT > INFO) is kept.
     
119. # Use: report_finding <SEVERITY> <session_file> <token_value> <message>
     
120. # SEVERITY is one of: CRITICAL, WARNING, ATTEMPT, INFO
     
121. report_finding() {
     
122.     local severity="$1"
     
123.     local session_file="$2"
     
124.     local token_val="$3"
     
125.     local message="$4"
     
126. 
     
127.     # Severity ranking: CRITICAL=3, WARNING=2, ATTEMPT=1, INFO=0
     
128.     local sev_rank=0
     
129.     case "$severity" in
     
130.         CRITICAL) sev_rank=3 ;;
     
131.         WARNING)  sev_rank=2 ;;
     
132.         ATTEMPT)  sev_rank=1 ;;
     
133.         INFO)     sev_rank=0 ;;
     
134.     esac
     
135. 
     
136.     local i found=0 prev_sev prev_rank
     
137.     for i in "${!FINDING_SESSIONS[@]}"; do
     
138.         if [ "${FINDING_SESSIONS[$i]}" = "$session_file" ]; then
     
139.             found=1
     
140.             prev_sev="${FINDING_SEVERITIES[$i]}"
     
141.             case "$prev_sev" in
     
142.                 CRITICAL) prev_rank=3 ;;
     
143.                 WARNING)  prev_rank=2 ;;
     
144.                 ATTEMPT)  prev_rank=1 ;;
     
145.                 INFO)     prev_rank=0 ;;
     
146.             esac
     
147.             if [ "$sev_rank" -le "$prev_rank" ]; then
     
148.                 # Existing finding is at least as severe; ignore.
     
149.                 return
     
150.             fi
     
151.             # Upgrade in place: replace severity, token, FINDINGS entry,
     
152.             # and roll back the previous severity counter so the new one
     
153.             # can be incremented below without double-counting.
     
154.             FINDING_SEVERITIES[$i]="$severity"
     
155.             [ -n "$token_val" ] && FINDING_TOKENS[$i]="$token_val"
     
156.             local j
     
157.             for j in "${!FINDINGS[@]}"; do
     
158.                 local entry="${FINDINGS[$j]}"
     
159.                 local entry_sev="${entry%%|*}"
     
160.                 local entry_file="${entry#*|}"; entry_file="${entry_file%%|*}"
     
161.                 if [ "$entry_file" = "$session_file" ] && [ "$entry_sev" = "$prev_sev" ]; then
     
162.                     FINDINGS[$j]="${severity}|${session_file}|${message}"
     
163.                     break
     
164.                 fi
     
165.             done
     
166.             case "$prev_sev" in
     
167.                 CRITICAL) COUNT_CRITICAL=$((COUNT_CRITICAL - 1)) ;;
     
168.                 WARNING)  COUNT_WARNING=$((COUNT_WARNING - 1))   ;;
     
169.                 ATTEMPT)  COUNT_ATTEMPT=$((COUNT_ATTEMPT - 1))   ;;
     
170.                 INFO)     COUNT_INFO=$((COUNT_INFO - 1))         ;;
     
171.             esac
     
172.             break
     
173.         fi
     
174.     done
     
175. 
     
176.     if [ "$found" -eq 0 ]; then
     
177.         FINDING_SESSIONS+=("$session_file")
     
178.         FINDING_TOKENS+=("$token_val")
     
179.         FINDING_SEVERITIES+=("$severity")
     
180.         FINDINGS+=("${severity}|${session_file}|${message}")
     
181.     fi
     
182. 
     
183.     case "$severity" in
     
184.         CRITICAL) COUNT_CRITICAL=$((COUNT_CRITICAL + 1)) ;;
     
185.         WARNING)  COUNT_WARNING=$((COUNT_WARNING + 1))   ;;
     
186.         ATTEMPT)  COUNT_ATTEMPT=$((COUNT_ATTEMPT + 1))   ;;
     
187.         INFO)     COUNT_INFO=$((COUNT_INFO + 1))         ;;
     
188.     esac
     
189. 
     
190.     echo "[${severity}] ${message}: ${session_file}"
     
191. }
     
192. 
     
193. # ---------------------------------------------------------------------------
     
194. # IOC checks
     
195. # ---------------------------------------------------------------------------
     
196. 
     
197. # IOC 0: token_denied counter alongside cp_security_token, in a session
     
198. # whose origin is badpass or otherwise non-benign.
     
199. #
     
200. # - token_denied is incremented by do_token_denied() (cpsrvd.pl:3821)
     
201. #   every time a request supplies the wrong cp_security_token. The
     
202. #   session is killed on the third failure.
     
203. # - cp_security_token itself is set by newsession() unconditionally
     
204. #   while security tokens are enabled (Cpanel/Server.pm:2290), so its
     
205. #   presence is NOT by itself an IOC. The pair (token_denied,
     
206. #   cp_security_token) tells us only that someone is actively trying
     
207. #   tokens against this session.
     
208. #
     
209. # Auth markers (successful_*_auth_with_timestamp, hasroot=1,
     
210. # tfa_verified=1, or an access_log hit on the security token) cannot
     
211. # legitimately appear in a badpass session: the badpass call site
     
212. # (Cpanel/Server.pm:1244-1252) doesn't pass them, hasroot is not even
     
213. # in _SESSION_PARTS (Cpanel/Server.pm:2216-2247), and tfa_verified is
     
214. # forced to 0 unless the caller passes a truthy value (line 2295).
     
215. #
     
216. # Severity tiers:
     
217. #   CRITICAL - badpass origin AND auth markers present (post-exploit)
     
218. #   INFO     - badpass origin, no auth markers, pass looks like a real
     
219. #              encoded password (likely an unrelated failed login that
     
220. #              happened to receive bad-token traffic)
     
221. #   WARNING  - origin is neither badpass nor a known-benign method
     
222. #              (handle_form_login, create_user_session,
     
223. #              handle_auth_transfer); the suspicious origin itself is
     
224. #              the IOC
     
225. #
     
226. # Legitimate badpass sessions never carry a pass= line (the badpass
     
227. # call site at Cpanel/Server.pm:1244-1252 does not pass `pass` to
     
228. # newsession, and saveSession only writes pass= when length is
     
229. # non-zero - Cpanel/Session.pm:181). When we see one anyway we defer
     
230. # classification to IOC 5 (check_failed_exploit_attempt), which flags
     
231. # it as ATTEMPT.
     
232. check_token_denied_with_injected_token() {
     
233.     local session_file="$1"
     
234. 
     
235.     grep -q '^token_denied='      "$session_file" || return
     
236.     grep -q '^cp_security_token=' "$session_file" || return
     
237. 
     
238.     local token_val external_auth internal_auth hasroot tfa used
     
239.     token_val=$(get_field      "$session_file" cp_security_token)
     
240.     external_auth=$(get_field  "$session_file" successful_external_auth_with_timestamp)
     
241.     internal_auth=$(get_field  "$session_file" successful_internal_auth_with_timestamp)
     
242.     hasroot=$(get_field        "$session_file" hasroot)
     
243.     tfa=$(get_field            "$session_file" tfa_verified)
     
244.     used=""
     
245.     if [ -r "$ACCESS_LOG" ]; then
     
246.         used=$(grep -aF -- "$token_val" "$ACCESS_LOG" | grep -m1 " 200 ")
     
247.     fi
     
248. 
     
249.     local has_auth_markers=0
     
250.     if [ -n "$external_auth" ] || [ -n "$internal_auth" ] \
     
251.        || [ "$hasroot" = "1" ] || [ "$tfa" = "1" ] || [ -n "$used" ]; then
     
252.         has_auth_markers=1
     
253.     fi
     
254. 
     
255.     if grep -q '^origin_as_string=.*method=badpass' "$session_file"; then
     
256.         if [ "$has_auth_markers" -eq 1 ]; then
     
257.             report_finding CRITICAL "$session_file" "$token_val" \
     
258.                 "Exploitation artifact - token_denied with injected cp_security_token (badpass origin, token used)"
     
259.         else
     
260.             # A pass= line on a badpass session is itself anomalous;
     
261.             # defer to IOC 5 (ATTEMPT).
     
262.             if grep -q '^pass=' "$session_file"; then
     
263.                 return
     
264.             fi
     
265.             report_finding INFO "$session_file" "$token_val" \
     
266.                 "Possible injected session (badpass origin, no usage observed)"
     
267.         fi
     
268.     elif grep -q '^origin_as_string=.*method=handle_form_login' "$session_file" || \
     
269.          grep -q '^origin_as_string=.*method=create_user_session' "$session_file" || \
     
270.          grep -q '^origin_as_string=.*method=handle_auth_transfer' "$session_file"; then
     
271.         # Known-benign origins where token_denied + cp_security_token
     
272.         # genuinely happens during normal use.
     
273.         return
     
274.     else
     
275.         report_finding WARNING "$session_file" "$token_val" \
     
276.             "Suspicious session with token_denied + cp_security_token (non-badpass origin)"
     
277.     fi
     
278. }
     
279. 
     
280. # IOC 1: A session that still has its pre-auth marker file but already
     
281. # contains an auth-success timestamp (external or internal).
     
282. #
     
283. # write_session creates $SESSIONS_DIR/preauth/<session_name> when the
     
284. # session is written with needs_auth=1, and removes that marker once
     
285. # needs_auth is cleared on promotion (Cpanel/Session.pm:225-235). A
     
286. # legitimately authenticated session therefore never has both the
     
287. # preauth marker and an auth-success timestamp at the same time.
     
288. #
     
289. # Both successful_external_auth_with_timestamp and
     
290. # successful_internal_auth_with_timestamp are checked: the original
     
291. # poc.py payload injects the external variant; the watchtowr payload
     
292. # (poc/poc_watchtowr.py:35) injects the internal variant.
     
293. check_preauth_with_auth_attrs() {
     
294.     local session_file="$1"
     
295.     local session_name preauth_file
     
296.     session_name=$(basename "$session_file")
     
297.     preauth_file="$SESSIONS_DIR/preauth/$session_name"
     
298. 
     
299.     [ -f "$preauth_file" ] || return
     
300. 
     
301.     local marker
     
302.     if grep -qE '^successful_external_auth_with_timestamp=' "$session_file"; then
     
303.         marker="successful_external_auth_with_timestamp"
     
304.     elif grep -qE '^successful_internal_auth_with_timestamp=' "$session_file"; then
     
305.         marker="successful_internal_auth_with_timestamp"
     
306.     else
     
307.         return
     
308.     fi
     
309. 
     
310.     report_finding CRITICAL "$session_file" \
     
311.         "$(get_field "$session_file" cp_security_token)" \
     
312.         "Injected session - ${marker} present in pre-auth session"
     
313. }
     
314. 
     
315. # IOC 2: tfa_verified=1 outside of a legitimate origin method.
     
316. #
     
317. # tfa_verified=1 is set in only two places:
     
318. #   - Cpanel/Security/Authn/TwoFactorAuth/Verify.pm:122, after a real
     
319. #     TFA token validation succeeds.
     
320. #   - Cpanel/Server.pm:2295, when a caller passes tfa_verified=1 to
     
321. #     newsession().
     
322. # In both cases the legitimate origin method is one of handle_form_login,
     
323. # create_user_session, or handle_auth_transfer. tfa_verified=1 with any
     
324. # other origin (notably badpass) cannot occur in a benign flow.
     
325. check_tfa_with_bad_origin() {
     
326.     local session_file="$1"
     
327. 
     
328.     grep -qE '^tfa_verified=1$' "$session_file" || return
     
329.     grep -q '^origin_as_string=.*method=handle_form_login'    "$session_file" && return
     
330.     grep -q '^origin_as_string=.*method=create_user_session'  "$session_file" && return
     
331.     grep -q '^origin_as_string=.*method=handle_auth_transfer' "$session_file" && return
     
332. 
     
333.     report_finding WARNING "$session_file" \
     
334.         "$(get_field "$session_file" cp_security_token)" \
     
335.         "Session with tfa_verified=1 but suspicious origin"
     
336. }
     
337. 
     
338. # IOC 3: Session file contains a line that is not in `key=value` form.
     
339. #
     
340. # Three structural invariants together guarantee that every legitimate
     
341. # line matches ^[A-Za-z_][A-Za-z0-9_]*=:
     
342. #
     
343. #   1. write_session serializes via Cpanel::Config::FlushConfig::flushConfig
     
344. #      with '=' as the separator (Cpanel/Session.pm:221), so the on-disk
     
345. #      format is one key=value pair per line.
     
346. #   2. Keys come from a fixed whitelist (_SESSION_PARTS at
     
347. #      Cpanel/Server.pm:2216-2247, applied at lines 2268-2270), so they
     
348. #      always match the identifier shape above.
     
349. #   3. Cpanel::Session::filter_sessiondata strips \r\n from every value
     
350. #      (Cpanel/Session.pm:315) and additionally strips \r\n=, from origin
     
351. #      sub-values (line 312), so values can never re-introduce line
     
352. #      breaks. The `pass` value is additionally encoded by saveSession
     
353. #      (Cpanel/Session.pm:181-189) into either lowercase hex (with-secret
     
354. #      via Cpanel::Session::Encoder->encode_data) or the literal prefix
     
355. #      `no-ob:` followed by lowercase hex (no-secret via
     
356. #      Cpanel::Session::Encoder->hex_encode_only), so it cannot
     
357. #      reintroduce structural characters either.
     
358. #
     
359. # Any non-blank line that fails the regex is the footprint of an
     
360. # injection that bypassed these invariants - typically raw payload bytes
     
361. # that didn't form valid key=value pairs. Note: an injection whose
     
362. # smuggled lines DO match key=value (e.g. the watchtowr payload at
     
363. # poc/poc_watchtowr.py:35, which fabricates successful_internal_auth_
     
364. # with_timestamp/user/tfa_verified/hasroot lines) will not trip this
     
365. # check; it is caught by IOC-0 and IOC-4 instead.
     
366. check_malformed_session_line() {
     
367.     local session_file="$1"
     
368. 
     
369.     # Look for any non-blank line that doesn't start with key=...
     
370.     grep -nE -v '^[A-Za-z_][A-Za-z0-9_]*=|^[[:space:]]*$' "$session_file" >/dev/null 2>&1 || return
     
371. 
     
372.     report_finding CRITICAL "$session_file" \
     
373.         "$(get_field "$session_file" cp_security_token)" \
     
374.         "Malformed session line(s) detected (not key=value - newline injection footprint)"
     
375. }
     
376. 
     
377. # IOC 4: badpass origin combined with markers that no legitimate cpsrvd
     
378. # code path writes into a badpass session.
     
379. #
     
380. # The badpass call site (Cpanel/Server.pm:1244-1252) is:
     
381. #
     
382. #   $randsession = $self->newsession(
     
383. #       'needs_auth' => 1,
     
384. #       %security_token_options,            # adds cp_security_token
     
385. #       'origin' => { 'method' => 'badpass' },
     
386. #   );
     
387. #
     
388. # %security_token_options is why badpass sessions legitimately carry
     
389. # cp_security_token, but no auth-related options are ever supplied.
     
390. # newsession() filters %OPTS through the _SESSION_PARTS whitelist
     
391. # (Cpanel/Server.pm:2216-2247, applied at lines 2268-2270), so any key
     
392. # not in that whitelist cannot land in the session via newsession at
     
393. # all. Per marker:
     
394. #
     
395. #   successful_external_auth_with_timestamp - whitelisted, but the
     
396. #       badpass caller doesn't pass it
     
397. #   successful_internal_auth_with_timestamp - same
     
398. #   tfa_verified=1 - newsession unconditionally writes 0 unless the
     
399. #       caller passed a truthy value (Cpanel/Server.pm:2295), and the
     
400. #       badpass caller doesn't
     
401. #   hasroot=1 - NOT in _SESSION_PARTS, so newsession cannot write it
     
402. #       for ANY session. A repo-wide grep finds no caller of
     
403. #       Cpanel::Session::Modify->set('hasroot', ...) either: hasroot is
     
404. #       never written to a session by legitimate code. Its presence in
     
405. #       any session file is conclusive evidence of newline injection
     
406. #       (the watchtowr payload at poc/poc_watchtowr.py:35 smuggles
     
407. #       hasroot=1 via \r\n in a user-controlled field).
     
408. check_badpass_with_auth_markers() {
     
409.     local session_file="$1"
     
410. 
     
411.     grep -q '^origin_as_string=.*method=badpass' "$session_file" || return
     
412. 
     
413.     local markers=()
     
414.     grep -q '^successful_external_auth_with_timestamp=' "$session_file" \
     
415.         && markers+=("successful_external_auth_with_timestamp")
     
416.     grep -q '^successful_internal_auth_with_timestamp=' "$session_file" \
     
417.         && markers+=("successful_internal_auth_with_timestamp")
     
418.     grep -qE '^hasroot=1$'      "$session_file" && markers+=("hasroot=1")
     
419.     grep -qE '^tfa_verified=1$' "$session_file" && markers+=("tfa_verified=1")
     
420. 
     
421.     [ "${#markers[@]}" -gt 0 ] || return
     
422. 
     
423.     local joined
     
424.     joined=$(IFS=,; echo "${markers[*]}")
     
425.     report_finding CRITICAL "$session_file" \
     
426.         "$(get_field "$session_file" cp_security_token)" \
     
427.         "badpass origin combined with authenticated markers ($joined) - impossible in benign flow"
     
428. }
     
429. 
     
430. # IOC 5: Failed exploit attempt - a badpass session that carries a
     
431. # pass= line, a token_denied counter, and no auth markers.
     
432. #
     
433. # A legitimate badpass session is created at Cpanel/Server.pm:1244-1252:
     
434. #
     
435. #   $randsession = $self->newsession(
     
436. #       'needs_auth' => 1,
     
437. #       %security_token_options,
     
438. #       'origin' => { 'method' => 'badpass' },
     
439. #   );
     
440. #
     
441. # %security_token_options carries only cp_security_token,
     
442. # requested_token_at_next_login, and previous_session_user
     
443. # (Cpanel/Server.pm:1205-1226) - never `pass`. saveSession only
     
444. # writes a pass= line when length($session_ref->{pass}) is non-zero
     
445. # (Cpanel/Session.pm:181), so legitimate badpass sessions have no
     
446. # pass= line at all.
     
447. #
     
448. # An exploit that tampers with a user-controlled field on a
     
449. # badpass-bound request leaves a pass= line behind (saveSession
     
450. # encodes it as `<hex>` or `no-ob:<hex>` per Cpanel/Session.pm:181-189,
     
451. # but the format is irrelevant - its presence is the indicator). Combined
     
452. # with token_denied (someone was poking at cp_security_token) and the
     
453. # absence of auth markers (the injection didn't promote - otherwise
     
454. # IOC-0 or IOC-4 fires CRITICAL), this is the signature of a failed
     
455. # exploit attempt.
     
456. check_failed_exploit_attempt() {
     
457.     local session_file="$1"
     
458. 
     
459.     grep -q '^origin_as_string=.*method=badpass' "$session_file" || return
     
460.     grep -q '^token_denied=' "$session_file" || return
     
461. 
     
462.     # If auth markers are present, IOC-4 (CRITICAL) handles it.
     
463.     grep -q '^successful_internal_auth_with_timestamp=' "$session_file" && return
     
464.     grep -q '^successful_external_auth_with_timestamp=' "$session_file" && return
     
465. 
     
466.     # Legitimate badpass sessions never carry pass=.
     
467.     grep -q '^pass=' "$session_file" || return
     
468. 
     
469.     report_finding ATTEMPT "$session_file" "$(get_field "$session_file" cp_security_token)" \
     
470.         "Failed exploit attempt (badpass origin, token_denied, no auth markers, anomalous pass= line)"
     
471. }
     
472. 
     
473. # ---------------------------------------------------------------------------
     
474. # Main
     
475. # ---------------------------------------------------------------------------
     
476. 
     
477. scan_sessions() {
     
478.     local session_file
     
479.     while IFS= read -r -d '' session_file; do
     
480.         check_token_denied_with_injected_token "$session_file"
     
481.         check_preauth_with_auth_attrs          "$session_file"
     
482.         check_tfa_with_bad_origin              "$session_file"
     
483.         check_malformed_session_line           "$session_file"
     
484.         check_badpass_with_auth_markers        "$session_file"
     
485.         check_failed_exploit_attempt           "$session_file"
     
486.     done < <(find "$SESSIONS_DIR/raw" -type f -print0 2>/dev/null)
     
487. }
     
488. 
     
489. 
     
490. print_summary() {
     
491.     local total=$((COUNT_CRITICAL + COUNT_WARNING + COUNT_INFO + COUNT_ATTEMPT))
     
492. 
     
493.     echo
     
494.     echo "================================================================="
     
495.     echo "                       SCAN SUMMARY"
     
496.     echo "================================================================="
     
497.     echo "  CRITICAL findings: $COUNT_CRITICAL"
     
498.     echo "  WARNING  findings: $COUNT_WARNING"
     
499.     echo "  ATTEMPT  findings: $COUNT_ATTEMPT"
     
500.     echo "  INFO     findings: $COUNT_INFO"
     
501.     echo "  Total            : $total"
     
502.     echo "-----------------------------------------------------------------"
     
503. 
     
504.     if [ "$total" -eq 0 ]; then
     
505.         echo "[+] No indicators of compromise found."
     
506.         return
     
507.     fi
     
508. 
     
509.     # --purge has destructive blast radius (live session files for every
     
510.     # logged-in user). Require either --yes for non-interactive use, or
     
511.     # an explicit "yes" at an attached TTY.
     
512.     if [ "$PURGE" -eq 1 ] && [ "$ASSUME_YES" -ne 1 ]; then
     
513.         if [ ! -t 0 ]; then
     
514.             echo "[ERROR] --purge requires --yes when stdin is not a TTY (cron, pipes, etc)" >&2
     
515.             echo "        Re-run with --yes to confirm deletion." >&2
     
516.             exit 64
     
517.         fi
     
518.         echo
     
519.         echo "About to delete ${#FINDING_SESSIONS[@]} session file(s) plus matching preauth markers."
     
520.         local confirm=""
     
521.         read -r -p "Type 'yes' to confirm: " confirm
     
522.         if [ "$confirm" != "yes" ]; then
     
523.             echo "[+] Aborted; no files deleted."
     
524.             PURGE=0
     
525.         fi
     
526.     fi
     
527. 
     
528. 
     
529.     # For each unique session, print only the highest-severity finding, then dump/purge as needed.
     
530.     local i session token severity message found=0
     
531.     for i in "${!FINDING_SESSIONS[@]}"; do
     
532.         session="${FINDING_SESSIONS[$i]}"
     
533.         token="${FINDING_TOKENS[$i]}"
     
534.         severity="${FINDING_SEVERITIES[$i]}"
     
535.         found=0
     
536.         # Find the first matching finding for this session and severity.
     
537.         # Use `read` with three names so the last variable (entry_msg)
     
538.         # absorbs any remaining `|` characters - the previous `${var##*|}`
     
539.         # form took only the suffix after the LAST `|`, which would
     
540.         # silently truncate any future message that contained one.
     
541.         for entry in "${FINDINGS[@]}"; do
     
542.             local entry_sev entry_file entry_msg
     
543.             IFS='|' read -r entry_sev entry_file entry_msg <<< "$entry"
     
544.             if [ "$entry_file" = "$session" ] && [ "$entry_sev" = "$severity" ]; then
     
545.                 message="$entry_msg"
     
546.                 found=1
     
547.                 break
     
548.             fi
     
549.         done
     
550.         echo
     
551.         echo "================================================================="
     
552.         echo "  SESSION: $session"
     
553.         echo "================================================================="
     
554.         echo "  Findings:"
     
555.         if [ "$found" -eq 1 ]; then
     
556.             printf "    [%-8s] %s\n" "$severity" "$message"
     
557.         else
     
558.             printf "    [%-8s] %s\n" "$severity" "(no message found)"
     
559.         fi
     
560.         echo
     
561.         if [ "$VERBOSE" -eq 1 ]; then
     
562.             dump_session "$session" "$token"
     
563.         fi
     
564.         if [ "$PURGE" -eq 1 ]; then
     
565.             echo "    [ACTION] Deleting session file: $session"
     
566.             rm -f -- "$session"
     
567.             local preauth_marker="$SESSIONS_DIR/preauth/$(basename "$session")"
     
568.             if [ -e "$preauth_marker" ]; then
     
569.                 echo "    [ACTION] Deleting preauth marker: $preauth_marker"
     
570.                 rm -f -- "$preauth_marker"
     
571.             fi
     
572.         fi
     
573.     done
     
574. 
     
575.     if [ "$COUNT_CRITICAL" -gt 0 ] || [ "$COUNT_WARNING" -gt 0 ]; then
     
576.         echo
     
577.         echo "[!] INDICATORS OF COMPROMISE DETECTED - IMMEDIATE ACTION REQUIRED"
     
578.         echo "    1. Purge all affected sessions"
     
579.         echo "    2. Force password reset for root and all WHM users"
     
580.         echo "    3. Audit /var/log/wtmp and WHM access logs for unauthorized access"
     
581.         echo "    4. Check for persistence mechanisms (cron, SSH keys, backdoors)"
     
582.     fi
     
583. }
     
584. 
     
585. if [ ! -d "$SESSIONS_DIR/raw" ]; then
     
586.     echo "[ERROR] Sessions directory not found: $SESSIONS_DIR/raw" >&2
     
587.     echo "        Pass --sessions-dir DIR to point at a different location" >&2
     
588.     echo "        (the default is /var/cpanel/sessions)." >&2
     
589.     exit 64
     
590. fi
     
591. 
     
592. echo "[*] Scanning session files for injection indicators..."
     
593. scan_sessions
     
594. print_summary
     
595. 
     
596. # Exit codes (for cron / monitoring):
     
597. #   2 - at least one CRITICAL or WARNING finding (compromise indicators)
     
598. #   1 - only ATTEMPT or INFO findings (probing, no confirmed compromise)
     
599. #   0 - clean scan
     
600. if [ "$COUNT_CRITICAL" -gt 0 ] || [ "$COUNT_WARNING" -gt 0 ]; then
     
601.     exit 2
     
602. elif [ "$COUNT_ATTEMPT" -gt 0 ] || [ "$COUNT_INFO" -gt 0 ]; then
     
603.     exit 1
     
604. fi
     
605. exit 0

複製代碼

如果確認伺服器已被root使用者入侵，則需要將cPanel帳號移轉到已知安全的伺服器上：





https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?_hsenc=p2ANqtz-_K3OQGhYmp27sKEqzJwRVauXmecf8h-pyDLetmnfoPRRKTnRl7z3H0PC6qKdbQfISSijwZ8JNVQMqVwyze5GYLKN3mYA&_hsmi=416839519&utm_content=416839519&utm_medium=email&utm_source=hs_email