How to implement PHP webshell to scan Trojan files

小云云
Release: 2023-03-19 19:06:01
Original
4259 people have browsed it

本文主要介绍PHP实现webshell扫描文件木马的方法,涉及php针对数值传输的过滤操作与文件识别等相关安全操作技巧,需要的朋友可以参考下,希望能帮助到大家。

可扫描 weevelyshell 生成 或加密的shell 及各种变异webshell

目前仅支持php

支持扫描 weevelyshell 生成 或加密的shell
支持扫描callback一句话shell
支持各种php大马


    PHP web shell scan 
invoke\(/is', '/PDO::FETCH_FUNC/', '/\$\w+.*\s?(?:=|->)\s?.*?[\'\"]assert[\'\"]\)?/i', '/\$\w+->(?:sqlite)?createFunction\(.*?\)/i', '/eval\([\"\']?\\\?\$\w+\s?=\s?.*?\)/i', '/eval\(.*?gzinflate\(base64_decode\(/i', '/copy\(\$HTTP_POST_FILES\[\'\w+\'\]\s?\[\'tmp_name\'\]/i', '/register_(?:shutdown|tick)_function\s?\(\$\w+,\s\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[.*?\]\)/is', '/register_(?:shutdown|tick)_function\s?\(?[\'\"]assert[\"\'].*?\)/i', '/call_user_func.*?\([\"|\']assert[\"|\'],.*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[[\'|\"].*\]\)+/is', '/preg_replace\(.*?e.*?\'\s?,\s?.*?\w+\(.*?\)/i', '/function_exists\s*\(\s*[\'|\"](popen|exec|proc_open|system|passthru)+[\'|\"]\s*\)/i', '/(exec|shell_exec|system|passthru)+\s*\(\s*\$_(\w+)\[(.*)\]\s*\)/i', '/(exec|shell_exec|system|passthru)+\s*\(\$\w+\)/i', '/(exec|shell_exec|system|passthru)\s?\(\w+\(\"http_.*\"\)\)/i', '/(?:john\.barker446@gmail\.com|xb5@hotmail\.com|shopen@aventgrup\.net|milw0rm\.com|www\.aventgrup\.net|mgeisler@mgeisler\.net)/i', '/Php\s*?Shell/i', '/((udp|tcp)\:\/\/(.*)\;)+/i', '/preg_replace\s*\((.*)\/e(.*)\,\s*\$_(.*)\,(.*)\)/i', '/preg_replace\s*\((.*)\(base64_decode\(\$/i', '/(eval|assert|include|require|include_once|require_once)+\s*\(\s*(base64_decode|str_rot13|gz(\w+)|file_(\w+)_contents|(.*)php\:\/\/input)+/i', '/(eval|assert|include|require|include_once|require_once|array_map|array_walk)+\s*\(.*?\$_(?:GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\)/i', '/eval\s*\(\s*\(\s*\$\$(\w+)/i', '/((?:include|require|include_once|require_once)+\s*\(?\s*[\'|\"]\w+\.(?!php).*[\'|\"])/i', '/\$_(\w+)(.*)(eval|assert|include|require|include_once|require_once)+\s*\(\s*\$(\w+)\s*\)/i', '/\(\s*\$_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$_(GET|POST|REQUEST|FILES)+\[(.*)\]\[(.*)\]\s*\)/i', '/(fopen|fwrite|fputs|file_put_contents)+\s*\((.*)\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\)/i', '/echo\s*curl_exec\s*\(\s*\$(\w+)\s*\)/i', '/new com\s*\(\s*[\'|\"]shell(.*)[\'|\"]\s*\)/i', '/\$(.*)\s*\((.*)\/e(.*)\,\s*\$_(.*)\,(.*)\)/i', '/\$_\=(.*)\$_/i', '/\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\)/i', '/\$(\w+)\s*\(\s*\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\)/i', '/\$(\w+)\s*\(\s*\$\{(.*)\}/i', '/\$(\w+)\s*\(\s*chr\(\d+\)/i' ); function antivirus($dir,$exs,$matches) { if(($handle = @opendir($dir)) == NULL) return false; while(false !== ($name = readdir($handle))) { if($name == '.' || $name == '..') continue; $path = $dir.$name; if(strstr($name,SELF)) continue; //$path=iconv("UTF-8","gb2312",$path); if(is_dir($path)) { //chmod($path,0777);/*主要针对一些0111的目录*/ if(is_readable($path)) antivirus($path.'/',$exs,$matches); } elseif(strpos($name,';') > -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) { echo '特征 '.$path.'

'; flush(); ob_flush(); } else { if(!preg_match($exs,$name)) continue; if(filesize($path) > 10000000) continue; $fp = fopen($path,'r'); $code = fread($fp,filesize($path)); fclose($fp); if(empty($code)) continue; if(weevelyshell($path)){ echo '特征 '.$path.'

'; flush(); ob_flush(); }elseif(callbackshell($path)){ echo '特征 '.$path.'

'; flush(); ob_flush(); } foreach($matches as $matche) { $array = array(); preg_match($matche,$code,$array); if(!$array) continue; if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue; $len = strlen($array[0]); if($len > 6 && $len < 200) { echo '特征 '.$path.'

'; flush(); ob_flush(); break; } } unset($code,$array); } } closedir($handle); return true; } function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); } echo '
'; echo '路径:

'; echo '后缀:

'; echo '操作:

'; echo '
'; if(file_exists($_POST['dir']) && $_POST['exs']) { $dir = strdir($_POST['dir'].'/'); $exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i'; echo antivirus($dir,$exs,$matches) ? '

扫描完毕!' : '

扫描中断'; } ?>
Copy after login

相关推荐:

PHP木马检测代码分享

如何查杀Linux系统下的木马

后门木马的10篇内容推荐

The above is the detailed content of How to implement PHP webshell to scan Trojan files. For more information, please follow other related articles on the PHP Chinese website!

Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template
About us Disclaimer Sitemap
php.cn:Public welfare online PHP training,Help PHP learners grow quickly!