PHP实现webshell扫描文件木马的方法

前端之家收集整理的这篇文章主要介绍了PHP实现webshell扫描文件木马的方法前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。

本文实例讲述了PHP实现webshell扫描文件木马的方法分享给大家供大家参考,具体如下:

可扫描 weevelyshell 生成 或加密的shell 及各种变异webshell

目前仅支持PHP

支持扫描 weevelyshell 生成 或加密的shell 支持扫描callback一句话shell 支持各种PHP大马

PHP;"> <a href="https://www.jb51.cc/tag/PHP/" target="_blank" class="keywords">PHP</a> web shell scan invoke\(/is','/PDO::FETCH_FUNC/','/\$\w+.*\s?(?:=|->)\s?.*?[\'\"]assert[\'\"]\)?/i','/\$\w+->(?:sqlite)?createFunction\(.*?\)/i','/eval\([\"\']?\\\?\$\w+\s?=\s?.*?\)/i','/eval\(.*?gzinflate\(base64_decode\(/i','/copy\(\$HTTP_POST_FILES\[\'\w+\'\]\s?\[\'tmp_name\'\]/i','/register_(?:shutdown|tick)_function\s?\(\$\w+,\s\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[.*?\]\)/is','/register_(?:shutdown|tick)_function\s?\(?[\'\"]assert[\"\'].*?\)/i','/call_user_func.*?\([\"|\']assert[\"|\'],.*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[[\'|\"].*\]\)+/is','/preg_replace\(.*?e.*?\'\s?,\s?.*?\w+\(.*?\)/i','/function_exists\s*\(\s*[\'|\"](popen|exec|proc_open|system|passthru)+[\'|\"]\s*\)/i','/(exec|shell_exec|system|passthru)+\s*\(\s*\$_(\w+)\[(.*)\]\s*\)/i','/(exec|shell_exec|system|passthru)+\s*\(\$\w+\)/i','/(exec|shell_exec|system|passthru)\s?\(\w+\(\"http_.*\"\)\)/i','/(?:john\.barker446@gmail\.com|xb5@hotmail\.com|shopen@aventgrup\.net|milw0rm\.com|www\.aventgrup\.net|mgeisler@mgeisler\.net)/i','/PHP\s*?Shell/i','/((udp|tcp)\:\/\/(.*)\;)+/i','/preg_replace\s*\((.*)\/e(.*)\,\s*\$_(.*)\,(.*)\)/i','/preg_replace\s*\((.*)\(base64_decode\(\$/i','/(eval|assert|include|require|include_once|require_once)+\s*\(\s*(base64_decode|str_rot13|gz(\w+)|file_(\w+)_contents|(.*)PHP\:\/\/input)+/i','/(eval|assert|include|require|include_once|require_once|array_map|array_walk)+\s*\(.*?\$_(?:GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\)/i','/eval\s*\(\s*\(\s*\$\$(\w+)/i','/((?:include|require|include_once|require_once)+\s*\(?\s*[\'|\"]\w+\.(?!PHP).*[\'|\"])/i','/\$_(\w+)(.*)(eval|assert|include|require|include_once|require_once)+\s*\(\s*\$(\w+)\s*\)/i','/\(\s*\$_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$_(GET|POST|REQUEST|FILES)+\[(.*)\]\[(.*)\]\s*\)/i','/(fopen|fwrite|fputs|file_put_contents)+\s*\((.*)\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\)/i','/echo\s*curl_exec\s*\(\s*\$(\w+)\s*\)/i','/new com\s*\(\s*[\'|\"]shell(.*)[\'|\"]\s*\)/i','/\$(.*)\s*\((.*)\/e(.*)\,'/\$_\=(.*)\$_/i','/\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\)/i','/\$(\w+)\s*\(\s*\$_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\)/i','/\$(\w+)\s*\(\s*\$\{(.*)\}/i','/\$(\w+)\s*\(\s*chr\(\d+\)/i' ); function antivirus($dir,$exs,$matches) { if(($handle = @opendir($dir)) == NULL) return false; while(false !== ($name = readdir($handle))) { if($name == '.' || $name == '..') continue; $path = $dir.$name; if(strstr($name,SELF)) continue; //$path=iconv("UTF-8","gb2312",$path); if(is_dir($path)) { //chmod($path,0777);/*主要针对一些0111的目录*/ if(is_readable($path)) antivirus($path.'/',$matches); } elseif(strpos($name,';') > -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) { echo '特征
'; flush(); ob_flush(); } else { if(!preg_match($exs,$name)) continue; if(filesize($path) > 10000000) continue; $fp = fopen($path,'r'); $code = fread($fp,filesize($path)); fclose($fp); if(empty($code)) continue; if(weevelyshell($path)){ echo '特征
'; flush(); ob_flush(); }elseif(callbackshell($path)){ echo '特征
'; flush(); ob_flush(); } foreach($matches as $matche) { $array = array(); preg_match($matche,$code,$array); if(!$array) continue; if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue; $len = strlen($array[0]); if($len > 6 && $len < 200) { echo '特征
'; flush(); ob_flush(); break; } } unset($code,$array); } } closedir($handle); return true; } function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); } echo '
'; echo '后缀: PHP|.inc|.phtml').'" style="width:398px;">
'; echo '操作:
'; echo ''; if(file_exists($_POST['dir']) && $_POST['exs']) { $dir = strdir($_POST['dir'].'/'); $exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i'; echo antivirus($dir,$matches) ? '
扫描完毕!' : '
扫描中断'; } ?>

更多关于PHP相关内容感兴趣的读者可查看本站专题:《》、《》、《》、《》、《》、《》、《》、《》及《PHP常见数据库操作技巧汇总》

希望本文所述对大家PHP程序设计有所帮助。

原文链接:https://www.f2er.com/php/17056.html
PHPwebshell扫描扫描扫描文件木马

猜你在找的PHP相关文章