import re, os

site = '/www/wwwroot/shfava.com'

# Remove disguised backdoor files
badfiles = [
    site + '/wp-includes/Text/Diff/Engine/oqrooqnpopsrrqnn.ttf',
    site + '/wp-includes/images/media/bdebbdacbcfeedaa.png',
    site + '/wp-includes/images/w-bdebbdacbcfeedaa.gif',
]
for f in badfiles:
    if os.path.exists(f):
        os.remove(f)
        print('REMOVED: ' + f)

# Clean @include base64_decode injections from PHP files
php_files = [
    site + '/wp-includes/template-loader.php',
    site + '/wp-includes/general-template.php',
    site + '/wp-includes/cron.php',
    site + '/wp-includes/functions.php',
    site + '/wp-blog-header.php',
]

for fpath in php_files:
    if not os.path.exists(fpath):
        continue
    os.system('chattr -i "' + fpath + '" 2>/dev/null')
    with open(fpath) as f:
        c = f.read()
    # Remove <?php @include base64_decode("...");?> injected at start
    fixed = re.sub(r'<\?php @include base64_decode\([^)]+\);\?>', '', c)
    if fixed != c:
        with open(fpath, 'w') as f:
            f.write(fixed)
        print('CLEANED: ' + fpath)
    else:
        print('NO MATCH: ' + fpath)

print('Done')