Home > Article > Backend Development > webshell transaction php Trojan webshell scanner code
webshell transaction php Trojan webshell scanner code
- WBOYOriginal
- 2016-07-29 08:47:453017browse
Copy the code The code is as follows:
/*
+---------------------------- --------------------------------------------------+
| Codz by indexphp Version:0.01 |
| (c) 2009 indexphp |
| http://www.indexphp.org |
+---------------------- -------------------------------------------------- --+
*/
/*===================== Program configuration================== ===*/
$dir='cms'; //Set the directory to be scanned
$jumpoff=false; //Set the files to skip checking
$jump='safe.php|g'; //Set This setting is effective when the file or folder to be skipped is $jumpoff=false
$danger='eval|cmd|passthru';//Set the dangerous function to be found to determine whether it is a Trojan file
$suffix='php| inc';//Set the suffix of the file to be scanned
$dir_num=0;
$file_num=0;
$danger_num=0;
/*================== === End of configuration=====================*/
extract (GetHttpVars());
if ($m=="edit") Edit() ;
if ($m=="del") Delete();
if ($check=='check')
{ $safearr = explode("|",$jump);
$start_time=microtime(true) ;
safe_check($dir);
$end_time=microtime(true);
$total=$end_time-$start_time;
$file_num=$file_num-$dir_num;
$message= "Number of files:".$file_num;
$message.= " Number of folders: ".$dir_num;
$message.= " Number of suspicious files: ".$danger_num;
$message.= " Execution time: ".$total;
echo $message;
exit();
}
function GetHttpVars() {//Global variables
$superglobs = array(
'_POST',
'_GET',
'HTTP_POST_VARS',
'HTTP_GET_VARS');
$httpvars = array() ;
foreach ($superglobs as $glob) {
global $$glob;
if (isset($$glob) && is_array($$glob)) {
$httpvars = $$glob;
}
if (count( $httpvars) > 0)
break;
}
return $httpvars;
}
function Safe_Check($dir)//Traverse files
{
global $danger ,$suffix ,$dir_num ,$file_num ,$danger_num;
$hand=@dir($dir) or die('The folder does not exist') ;
while ($file=$hand->read() )
{
$filename=$dir.'/'.$file ;
if (!$jumpoff) {
if(Jump($filename))continue;
}
if(@is_dir($filename) && $file != '.' && $file!= '..'&& $ file!='./..')
{ $dir_num++;
Safe_Check($filename);
}
if (preg_match_all ("/.($suffix)/i",$filename,$out))
{
$str='';
$fp = @fopen($filename,'r')or die('no permission');
while(!feof($fp))
{
$str .= fgets($fp ,1024);
}
fclose($fp);
if( preg_match_all ("/($danger)[ rnt]{0,}([[(])/i",$str,$out))
{
echo "Suspicious file: {$filename}
Delete
";
$danger_num++;
}
}
$file_num++;
}
}
function Edit()//View suspicious files
{
global $filename;
$filename = str_replace("..","",$ filename);
$file = $filename;
$content = "";
if(is_file($file))
{
$fp = fopen($file,"r")or die('no permission');
$content = fread($fp,filesize($file));
fclose($fp);
$content = htmlspecialchars($content);
}
echo "