php网站安全分析,网站安全分析：PHP ob_start函数后门分析报告

set_time_limit(0);

function find($directory)

{

$mydir=dir($directory);

while($file=$mydir->read()){

if((is_dir("$directory/$file"))&&($file!=".")&&($file!=".."))

{

find("$directory/$file");

}

else{

if($file != "." && $file != ".."&&eregi(".php",$file)){

$fd=realpath($directory."/".$file);

$fp = fopen($fd, "r");

$i=0;

while ($buffer = fgets($fp, 4096)) {

$i++;  if((eregi("eval\(\\$\_POST",$buffer))||(eregi("system\(",$buffer))||(eregi("exec\(",$buffer))||(eregi("shell_exec\(",$buffer))||(eregi("popen\(",$buffer))||(eregi("phpinfo\(",$buffer))||(eregi("passthru\(",$buffer))||(eregi("proc_open\(",$buffer))||(eregi("phpspy",$buffer))||(eregi("eval\(base64",$buffer))||(eregi("eval\(gzuncompress",$buffer))||(eregi("preg_replace\(\/^\/e,\$",$buffer))||(eregi("preg_replace\(\"\/\^\/e",$buffer))||(eregi("assert\(",$buffer))||(eregi("ob_start\(",$buffer))||(eregi("error_log\(",$buffer))||(eregi("dl\(",$buffer))){

all();

echo "可疑文件路径:".$fd."\r\nLine".$i.":".$buffer."\r\n\r\n";

}

}

fclose($fp);

}

}

}

$mydir->close();

}

function all()

{

static $count = 1;

echo $count;

$count++;

}

find($argv[1]);

?>