|
|
<?php
/*
+--------------------------------------------------------------------------+
| Codz by indexphp Version:0.01 |
| (c) 2009 indexphp |
| http://www.indexphp.org |
+--------------------------------------------------------------------------+
*/
/*===================== 程序配置 =====================*/
$dir='cms'; //設(shè)置要掃描的目錄
$jumpoff=false;//設(shè)置要跳過檢查的文件
$jump='safe.php|g'; //設(shè)置要跳過檢查的文件或者文件夾 $jumpoff=false 時(shí)此設(shè)置有效
$danger='eval|cmd|passthru';//設(shè)置要查找的危險(xiǎn)的函數(shù) 以確定是否木馬文件
$suffix='php|inc';//設(shè)置要掃描文件的后綴
$dir_num=0;
$file_num=0;
$danger_num=0;
/*===================== 配置結(jié)束 =====================*/
extract (GetHttpVars());
if ($m=="edit") Edit();
if ($m=="del") Delete();
if ($check=='check')
{ $safearr = explode("|",$jump);
$start_time=microtime(true);
safe_check($dir);
$end_time=microtime(true);
$total=$end_time-$start_time;
$file_num=$file_num-$dir_num;
$message= " 文件數(shù):".$file_num;
$message.= " 文件夾數(shù)：".$dir_num;
$message.= " 可疑文件數(shù)：".$danger_num;
$message.= " 執(zhí)行時(shí)間：".$total;
echo $message;
exit();
}
function GetHttpVars() {//全局變量
$superglobs = array(
'_POST',
'_GET',
'HTTP_POST_VARS',
'HTTP_GET_VARS');
$httpvars = array();
foreach ($superglobs as $glob) {
global $$glob;
if (isset($$glob) && is_array($$glob)) {
$httpvars = $$glob;
}
if (count($httpvars) > 0)
break;
}
return $httpvars;
}
function Safe_Check($dir)//遍歷文件
{
global $danger ,$suffix ,$dir_num ,$file_num ,$danger_num;
$hand=@dir($dir) or die('文件夾不存在') ;
while ($file=$hand->read() )
{
$filename=$dir.'/'.$file;
if (!$jumpoff) {
if(Jump($filename))continue;
}
if(@is_dir($filename) && $file != '.' && $file!= '..'&& $file!='./..')
{ $dir_num++;
Safe_Check($filename);
}
if (preg_match_all ("http://.($suffix)/i",$filename,$out))
{
$str='';
$fp = @fopen($filename,'r')or die('沒有權(quán)限');
while(!feof($fp))
{
$str .= fgets($fp,1024);
}
fclose($fp);
if( preg_match_all ("/($danger)[ /r/n/t]{0,}([/[/(])/i",$str,$out))
{
echo "<font color='green' style='font-size:14px'>可疑文件：{$filename}</font>
<a href='?m=edit&filename=$filename' target='_blank'><u>查看代碼</u></a>
<a href='?m=del&filename=$filename' target='_blank'>刪除</u></a><br>";
$danger_num++;
}
}
$file_num++;
}
}
function Edit()//查看可疑文件
{
global $filename;
$filename = str_replace("..","",$filename);
$file = $filename;
$content = "";
if(is_file($file))
{
$fp = fopen($file,"r")or die('沒有權(quán)限');
$content = fread($fp,filesize($file));
fclose($fp);
$content = htmlspecialchars($content);
}
echo "<textarea name='str' style='width:100%;height:450px;background:#cccccc;'>$content</textarea>/r/n";
exit();
}
function Delete()//刪除文件
{
global $filename;
(is_file($filename))?($mes=unlink($filename)?'刪除成功':'刪除失敗 查看權(quán)限'):'';
echo $mes;
exit();
}
function Jump($file)//跳過文件
{
global $jump,$safearr;
if($jump != '')
{
foreach($safearr as $v)
{
if($v=='') continue;
if( eregi($v,$file) ) return true ;
}
}
return false;
}
?>
<form action="" >
<input type="submit" value="開始檢測" />
<input type="hidden" name="check" value="check"/>
</form>
php技術(shù)：php木馬webshell掃描器代碼，轉(zhuǎn)載需保留來源！
鄭重聲明：本文版權(quán)歸原作者所有，轉(zhuǎn)載文章僅為傳播更多信息之目的，如作者信息標(biāo)記有誤，請(qǐng)第一時(shí)間聯(lián)系我們修改或刪除，多謝。
