shell 常用脚本 不定时更新

1.清除当前目录所有项目缓存

#!/bin/bash

# 函数用于清理 thinkcmf 类型的目录
clean_thinkcmf() {
    local dir="$1"
    if [ -d "$dir/data/runtime/api" ]; then
        rm -rf "$dir/data/runtime/api/"
    fi
    if [ -d "$dir/data/runtime/cache" ]; then
        rm -rf "$dir/data/runtime/cache/"
    fi
    if [ -d "$dir/data/runtime/log" ]; then
        rm -rf "$dir/data/runtime/log/"
    fi
    if [ -d "$dir/data/runtime/temp" ]; then
        rm -rf "$dir/data/runtime/temp/"
    fi
}

# 函数用于清理 fastadmin 类型的目录
clean_fastadmin() {
    local dir="$1"
    if [ -d "$dir/addons" ] && [ -d "$dir/runtime" ]; then
        rm -rf "$dir/runtime/log/"
        rm -rf "$dir/runtime/temp/"
        rm -rf "$dir/runtime/cache/"
    fi
}

find . -maxdepth 1 -type d -not -name '.*' -print0 | while IFS= read -r -d '' file; do
    echo "$file"
    if [ -d "$file/addons" ]; then
        echo "fastadmin"
        clean_fastadmin "$file"
    else
        echo "thinkcmf"
        clean_thinkcmf "$file"
    fi
done

echo "<br />"
date
echo '------------------------------------------------------#END-------------------------------------------';

2.查找删除被篡改的 js 脚本文件

#!/bin/bash
search_dir="."

matched_num=0

# 使用trap命令在脚本退出时显示匹配的文件数
#trap "echo 总共检查了$matched_num个文件" EXIT
echo "开始检查..."
date
# 定义一个函数来处理文件搜索和可能的删除
process_file() {
    local file="$1"
    matched_num=0
   local search_string="isfirstvisited|20240224"

   # ((matched_num++))
    #echo -ne "\r已搜索 $matched_num 个文件"
    # printf  "\r文件$file\r"
   #  printf "检查文件数:$matched_num\r"
     #echo "字符传$search_string"
    if grep -ERnl "$search_string" "$file"; then
        rm "$file"
        echo "已删除"
        #echo "注意: 脚本当前不会删除文件，只是显示它们。"
    fi
}
export -f process_file  # 导出函数，使其可以在子shell中使用
# 使用find命令和xargs结合来并行搜索文件
# 注意：我们传递-n 1给xargs来确保每次只处理一个文件，因为删除操作是串行的
find "$search_dir" -type f -name '*.js' -print0 | xargs -0 -n 1 -P 4 bash -c 'process_file "$@"' --

date
echo "总共找到了 $matched_num 个匹配的文件。"

3.正则匹配 查找被webshell篡改的php文件（一般情况是大马）

#!/bin/bash
search_dir="/alidata/www/"

matched_num=0

# 使用trap命令在脚本退出时显示匹配的文件数
#trap "echo 总共检查了$matched_num个文件" EXIT
echo "开始检查..."
date
# 定义一个函数来处理文件搜索和可能的删除
process_file() {
    local file="$1"
    matched_num=0
   local search_string="http://67.198.186.42:8080|PGNlbnRlcj4KCQk8Zm9ybSBtZXRob2Q9|zazl71Buw2rAxKXu1UUQsOpKgheABEBSpKiD02g0gCYbaKi|evwOvU9aq1qS4JBEjq6ipbgISYBAghBnffejRLoAmN|fl3HNd5J4z/zJzj/6HchtWAiaX2hRBo1UqCC0ACIClS1I|error_reporting(0);$sr=|CQ9jnUNtDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXG|http://Www.PHPJiaMi.Com/|QwqmnKALxMaluBQpYSXBBSQA7sUaKpFIAEkkkBASIIiS1P9F9sz|phpc.sinaapp.com|zazl73BUhlWAieHMAyHQOiMJDgAJgKRIUS9uoVAAiiigSlUFghTF|PCVAIFBhZ2UgTGFuZ3VhZ2U9IkMjIiBBdXRvRXZlbnRXaXJl|Udp1-fsockopen|SAiOi8vIjsrrKCrriAgICBpZiArro|5bfdad151f5a624c3b137c|aishen\($_POST|103.39.78.71|90sec.org|b7zBh3UpK9fYjiW05dRyl8T2J|103.212.34.141|bbfe943aead94e11dc33b7b5138843c1|sakemm.cn|yosq.com|www.arftv.cn|21232f297a57a5a743894a0e4a801fc3|jinsha668|034c7b1e0ae5b510f6e70a|QsOpKgheABEBSpK|23.252.161.21|100.43.136.34|www.xvidmate.com|DQoNCi8vJHBhc3N3b3JkID0|sm.0551001.com|m.kuaibocun.com|100.43.136.34|imcaccess.applinzi.com|acedgwf.cn|21232f297a57a5a743894a0e4|Gif89a|<>62@1|3c6e0b8a9c15224a|yinhe2022|yinhe062|yinhe456|93184ca9be7|640e4ca99469|469722r272s27293o|jVUNb5swEP0B+RUWigTRMsgqTaoWdV3a0Y|www.cn6566.com|JGEgPSBsdHJpbSg|httpGetlai|V9nZXRfY29udG|jVUNb5swEP0B+RUWigTRM|154.204.168.66|workerdata.org|zxczxczxczxc|ZG5zknRfS|JGEgPSBsdHJpbSgnbW1tYkFzRTY0X|D9waHAKJGFiID0gJF9|16o3o0q0n7q|2470617373776F72643D27|66756r6374696s6r20737|19908888882|6s625s737461727428293o0q0n646566696r65|sm_context_create|4a40e01e278853d0abddb12057a|d31b7d21395a26b8|L35dxzXfSf6M32|dtfQeIudTB9Bnr1Xfe|66756r6374696s6r20737472646|66756r6374696s6r20737472|0x633A5C5C77696E646F77735C|QUHeDiyj+MY|66756r6374696s6r20737472646i|PHPJiaMi|ok1234567|D3WyLKEyK0M1ozA0nJ9h|576616p28677n756r636s6q|2470617373776|69722824737|6s625s737461727428293o0q0|TnJuQHjYrWTrlqS7I6|CIQnMEdpMBoMBh|VvjvWl4xoKEc|66756r6374696s6r2073|W0BldmFsKGJhc2U2NF9kZ|d1pZpcnp7Qki|370696465727|576616p28677n7|zSgMG0vL2ue|470617373776F72643D2|7068705f756e616d6|21232f297a57a5a743894|PHPJiaMi|66756r63746|3HNd5J4z|a0qtpZwrdbc|jrQfvVT9hL2|576616p28677n7|zfLBqQ68M2te4+7|XZBBT4NAEIXPNOl|navigator.userAgent.toLocaleLowerCase|6576616p286|66756r6374696s6|EBFFBDFFCD|fl3HNd5J4z|66756r6374696s6r20|input name=\"fn\" size=\"20|create_function\(NULL|include\('4.jpg'\)|W0BldmFsKGJh|2470617373776F7|jinsha668|66756r6374696s6r|6d31b7d21395a26b80|6576616p28677n756r|designwoop"

    ((matched_num++))
    #echo -ne "\r已搜索 $matched_num 个文件"
    # printf  "\r文件$file\r"
   #  printf "检查文件数:$matched_num\r"
     #echo "字符传$search_string"
    if grep -ERnl "$search_string" "$file"; then
        rm "$file"
        echo "已删除"
        #echo "注意: 脚本当前不会删除文件，只是显示它们。"
    fi
}
export -f process_file  # 导出函数，使其可以在子shell中使用
# 使用find命令和xargs结合来并行搜索文件
# 注意：我们传递-n 1给xargs来确保每次只处理一个文件，因为删除操作是串行的
find "$search_dir" -type f -name '*.php' -print0 | xargs -0 -n 1 -P 1 bash -c 'process_file "$@"' --

date
echo "总共找到了 $matched_num 个匹配的文件。"

4.匹配查找一句话木马（一般情况是小马）

#/bin/bash
echo "<br />";
date
echo "<br />"
#grep -ERnl  --include=*.php '^<\?php.{0,200}(eval|assert).{2,200}\?>$'  /alidata/www/online
#grep -ERnl --include=*.php 'navigator.userAgent.toLocaleLowerCase' /alidata/www/|xargs rm
#grep -ERnl --include=index.php 'navigator.userAgent.toLocaleLowerCase' /alidata/www/
grep -ERnl --include=index.php '<script>' /alidata/www/|xargs rm
echo "<br />"
date
echo "<br />"
echo  '------------------------------------------------------#END-------------------------------------------';                                                                                                                          

5.查找runtime文件夹 并删除对应缓存

#!/bin/bash

find .  -maxdepth 4 -type d -name "runtime" | while read -r dir; do
    echo "Found runtime directory: $dir"
    if [ -d "$dir" ]; then
        rm -rf "$dir/cache/"
        rm -rf "$dir/log/"
        rm -rf "$dir/temp/"
        echo "Cleared files in $dir."
    else
        echo "Directory $dir not found or is not accessible."
    fi
done

echo "<br />"
date
echo '------------------------------------------------------#END-------------------------------------------';