如何分辨php文件有没有木马,扫描目录下的php文件，是不是含有木马特征

扫描目录下的php文件，是否含有木马特征

shell_checkl

#!/usr/bin/python#-*- encoding:UTF-8 -*-##### @package## @desc 扫描目录下的php文件，是否含有木马特征，注意，不是“木马扫描”## @useage python shell_check.py /your/web/path/ 1=是否递归###import osimport sysimport reimport timedef listdir(dirs,liston='0'): flog = open(os.getcwd()+"/check_php_shell.log","a+") if not os.path.isdir(dirs): print "directory %s is not exist"% (dirs) return lists = os.listdir(dirs) for list in lists: filepath = os.path.join(dirs,list) if os.path.isdir(filepath): if liston == '1': listdir(filepath,'1') elif os.path.isfile(filepath): filename = os.path.basename(filepath) if re.search(r"\.(?:php|inc|html?)$", filename, re.IGNORECASE): i = 0 iname = 0 f = open(filepath) while f: file_contents = f.readline() if not file_contents: break i += 1 match = re.search(r'''(?P\b(?:include|require)(?:_once)?\b)\s*\(?\s*["'](?P.*?(?eval|proc_open|popen|shell_exec|exec|passthru|system)\b\s*\(', file_contents, re.IGNORECASE| re.MULTILINE) if match: function = match.group("function") if iname == 0: info = '\n[%s] :\n'% (filepath) else: info = '' info += '\t|-- [%s] line [%d] \n'% (function,i) flog.write(info) print info iname += 1 match = re.findall(r'(\$[a-z0-9_]*?\s*?\(.*?\))', file_contents, re.IGNORECASE) if match: if iname == 0: info = '\n[%s] :\n'% (filepath) else: info = '' info += '\t|-- [%s] line [%d] \n'% (match[0],i) flog.write(info) print info iname += 1 f.close() flog.close()if '__main__' == __name__: argvnum = len(sys.argv) liston = '0' if argvnum == 1: action = os.path.basename(sys.argv[0]) print "Command is like:\n %s D:\wwwroot\ \n %s D:\wwwroot\ 1 -- recurse subfolders"% (action,action) quit() elif argvnum == 2: path = os.path.realpath(sys.argv[1]) listdir(path,liston) else: liston = sys.argv[2] path = os.path.realpath(sys.argv[1]) listdir(path,liston) flog = open(os.getcwd()+"/check_php_shell.log","a+") ISOTIMEFORMAT='%Y-%m-%d %X' now_time = time.strftime(ISOTIMEFORMAT,time.localtime()) flog.write("\n----------------------%s checked ---------------------\n"% (now_time)) flog.close()

相关文章

相关视频