在线检测php后门,php后门简单检测脚本

# coding:utf-8

import os

import sys

import re

rulelist = [

'(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))',

'(base64_decode\([\'"][\w\+/=]{200,}[\'"]\))',

'eval\(base64_decode\(',

'(eval\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

'(assert\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

'(\$[\w_]{0,15}\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

'(wscript\.shell)',

'(gethostbyname\()',

'(cmd\.exe)',

'(shell\.application)',

'(documents\s+and\s+settings)',

'(system32)',

'(serv-u)',

'(提权)',

'(phpspy)',

'(后门)',

'(webshell)',

'(Program\s+Files)'

]

def Scan(path):

for root,dirs,files in os.walk(path):

for filespath in files:

isover = False

if '.' in filespath:

ext = filespath[(filespath.rindex('.')+1):]

if ext=='php':

file= open(os.path.join(root,filespath))

filestr = file.read()

file.close()

for rule in rulelist:

result = re.compile(rule).findall(filestr)

if result:

print '文件：'+os.path.join(root,filespath)

print '恶意代码：'+str(result[0])

print '\n\n'

break

if os.path.lexists(sys.argv[1]):

print('\n\n开始扫描：'+sys.argv[1])

print(' 可疑文件 ')

print('########################################')

Scan(sys.argv[1])

print('提示：扫描完成-- O(∩_∩)O哈哈~')

else:

print '提示：指定的扫描目录不存在--- 我靠( \'o′)！！凸'